[LTA-ITCD] SNR/EXEC CYBERSECURITY ENGINEER, CYBER ARCHITECTURE & DEVT

Government Technology Agency (GovTech); Singapore; On-site; SGD 90,000 - 130,000; Full time

Job summary

This role blends hands-on offensive security with capability development, governance, and stakeholder engagement to elevate cybersecurity assurance across large-scale digital systems.

Qualifications

• Minimum 2 years of hands-on experience in VAPT or security engineering.
• Hands-on capability with VAPT methodologies and common tools.
• Experience with adversary emulation, red/purple teaming, or MITRE ATT&CK.
• Familiarity with AI, ML concepts, and AI-assisted security testing."],
• job_responsibilities_description [

Skills

VAPT

Adversarial Testing

AI in VAPT

Secure Architecture

Risk Assessment

Security Governance

Cloud Security

Stakeholder Engagement

Job description

[What the role is] SENIOR / EXECUTIVE CYBERSECURITY ENGINEER, CYBER ARCHITECTURE & DEVELOPMENT [What you will be working on] Join a forward looking cybersecurity team where your technical expertise will directly strengthen the resilience of critical digital systems. You will work on high-impact Vulnerability Assessment and Penetration Testing (VAPT), build our in-house Adversarial Attack Simulation (AAS) capability, and advise project teams on secure architecture and implementation. You will also have the opportunity to explore and shape the responsible use of Artificial Intelligence (AI) in VAPT, helping us improve testing depth, speed, consistency, and insight. This role offers a distinctive blend of hands-on offensive security, capability development, innovation, and stakeholder engagement, with opportunities to influence how cybersecurity assurance evolves across the organisation.

Key responsibilities

• Lead and deliver end-to-end VAPT across applications, infrastructure, networks, and cloud environments by identifying exploitable weaknesses, validating business impact, and helping system owners remediate effectively.
• Design and execute safe, controlled Adversarial Attack Simulation exercises that emulate realistic threat actors and attack paths, revealing blind spots across preventive, detective, response, and recovery controls.
• Explore, prototype, and evaluate AI-enabled approaches for VAPT, including test planning, attack-path analysis, vulnerability triage, evidence correlation, report generation, and remediation guidance, with appropriate governance and human oversight.
• Serve as a trusted cybersecurity advisor to digital projects by conducting risk assessments, reviewing security architecture, and recommending practical, risk-informed security solutions.
• Partner with architects, developers, project teams, system owners, vendors, and security operations teams to embed secure-by-design practices throughout the system lifecycle.
• Track emerging vulnerabilities, attacker techniques, AI-enabled threats, and security technologies, translating developments into stronger testing methods, playbooks, and defensive improvements.
• Analyse and trend cybersecurity findings across VAPT, AAS, and other assurance activities to identify recurring weaknesses, systemic root causes, risk concentrations, and emerging patterns, translating these insights into dashboards, targeted remediation priorities, and improvements to security standards, testing playbooks, and preventive controls.
• Communicate complex technical findings clearly to both technical and non-technical stakeholders, turning assessment results into prioritised and actionable recommendations.

What you can look forward to

• meaningful work that protects critical services
• exposure to diverse technology environments
• opportunities to build new VAPT, AAS, and AI-assisted testing capabilities
• a collaborative setting that supports experimentation, professional development, and knowledge sharing

What we are looking for

• Knowledge in Cybersecurity, Computer Science, Information Technology, or a related discipline, or equivalent relevant experience.
• OSCP, a relevant CREST certification, or an equivalent hands-on offensive security credential is preferred.
• CISSP (Certified Information Systems Security Professional), CISM (Certified Information Security Manager), CRISC (Certified in Risk and Information Systems Control), and CISA (Certified Information Systems Auditor) certifications are advantageous.
• At least 2 years of relevant experience in VAPT, offensive security, cybersecurity engineering, or security consultancy; candidates with strong practical capability gained through labs, competitions, research, or substantial independent projects may also be considered.
• Demonstrated hands-on capability with VAPT methodologies, manual testing techniques, and commonly used security assessment tools.
• Experience with adversary emulation, red teaming, purple teaming, attack frameworks such as MITRE ATT&CK, or the validation of security monitoring and incident response capabilities is advantageous.
• Familiarity with AI and machine learning concepts, large language models, AI‑assisted security testing tools, scripting, or security automation, together with an understanding of responsible AI use and associated risks, is advantageous.
• Strong understanding of cloud configuration, network security, encryption, and authentication protocols.
• Strong analytical and problem‑solving skills, with the ability to work independently, collaborate across teams, manage priorities, and explain technical risks clearly in writing and conversation.

The Singapore Public Service plays a key role in the economic growth, progress and stability of Singapore by formulating and implementing government policies, as well as providing key public services. Whether you are a fresh graduate joining the workforce or an experienced professional, the Singapore Public Service offers a great variety of job opportunities for you. The work in the Public Service can be broadly categorised into the following sectors: Economic, Social, Security & External Relations, and Administration & Corporate Development. Be part of the team that shapes the future of Singapore.