Security Analyst

Tap Growth ai; Singapore; On-site; SGD 60,000 - 90,000; Full time

Job summary

Tap Growth ai is seeking a Security Analyst in Singapore to own the vulnerability management lifecycle from intake to closure, coordinating remediation with engineering and DevOps teams.

You will apply CVSS and internal risk criteria, conduct quarterly assessments, and support audits while reporting security posture to leadership. Hands-on experience with Tenable/Qualys is preferred.

Qualifications

• 2+ years of experience in information security or vulnerability management.
• Hands-on experience with vulnerability scanning platforms such as Tenable, Qualys, Rapid7, Wiz, or similar.
• Strong understanding of CVSS scoring and risk-based prioritization.
• Experience communicating security findings to technical teams and business stakeholders.
• Familiarity with NIST CSF, ISO 27001, SOC 2.
• Familiarity with GovTech's IM8 policies and risk assessment methodology.
• Strong organizational skills to manage multiple workstreams and deadlines.

Responsibilities

• Own and manage the end-to-end Vulnerability Management process from intake to lifecycle tracking.
• Classify vulnerabilities by severity and business impact using CVSS/EPSS and internal criteria.
• Plan and manage quarterly vulnerability assessments, including scoping and tool engagement.
• Manage yearly penetration testing cycle, including vendor coordination and remediation tracking.
• Track remediation end-to-end, including WAF transitions from detection to prevention.
• Coordinate with remediation teams to ensure timely resolution and documented prioritization.
• Maintain risk acceptance records with proper approvals and periodic reviews.
• Report remediation SLAs and escalate high-risk items to stakeholders.
• Produce status reports and dashboards communicating security posture to all audiences.

Skills

Vulnerability management

CVSS scoring

Stakeholder communication

Project management

Policy & compliance

Threat awareness

Tools

Tenable

Qualys

Rapid7

Wiz

Jira

ServiceNow

Job description

We're Hiring: Security Analyst!

Location: Singapore, Singapore
Work Mode: Work from Office
Role: Security Analyst

Key Responsibilities

• Own and manage the end-to-end Vulnerability Management process, including intake, triage, and lifecycle tracking of security findings across the organization's systems and assets.
• Classify vulnerabilities by severity, exploitability, and business impact using frameworks such as CVSS, EPSS, and internal risk criteria.
• Plan, coordinate, and manage Quarterly Vulnerability Assessments — scoping targets, engaging scanning tools, reviewing outputs, and driving findings through to resolution.
• Manage the Yearly Penetration Testing cycle, including scoping, vendor coordination, findings review, and tracking remediation commitments through to closure.
• Track key remediation implementations end-to-end, maintaining visibility from initial detection through to verified closure — for example, overseeing the transition of WAF rules from detection mode to prevention mode, ensuring each step is documented, tested, and signed off.
• Coordinate with remediation teams (engineering, DevOps, infrastructure) to ensure timely resolution of findings, providing clear context and prioritization guidance.
• Maintain and update risk acceptance records, ensuring appropriate approvals are obtained, documented, and reviewed on schedule.
• Track and report on remediation SLAs, escalating overdue or high-risk items to the appropriate stakeholders.
• Produce regular status reports and dashboards that communicate the project's overall security posture to technical and non-technical audiences.

Security Visibility & Reporting

• Aggregate vulnerability data from multiple scanning tools and sources into a coherent, unified view of security risk.
• Develop and maintain metrics and KPIs that enable leadership visibility into ongoing security exposure and program effectiveness.
• Present findings, trends, and recommendations in written reports, executive briefings, and team meetings.

Collaboration & Process Improvement

• Act as a liaison between the security team and remediation owners, facilitating communication and removing blockers to resolution.
• Continuously improve vulnerability management workflows, tooling, and documentation.
• Support audit and compliance activities by providing evidence of vulnerability tracking and risk treatment processes.
• Contribute to threat intelligence efforts and stay current on emerging CVEs and attack trends relevant to the organization.

Qualifications Required

• 2+ years of experience in an information security, vulnerability management, or related role.
• Hands-on experience with vulnerability scanning platforms (e.g., Tenable, Qualys, Rapid7, Wiz, or similar).
• Solid understanding of CVSS scoring, vulnerability classification, and risk-based prioritization.
• Experience communicating security findings and risk to both technical teams and business stakeholders.
• Familiarity with common compliance and risk frameworks (e.g., NIST CSF, ISO 27001, SOC 2).
• Familiarity with GovTech's IM8 (Instruction Manual 8) policies and its associated risk-based assessment methodology, including the application of controls, classification of government ICT systems, and conducting or supporting IM8-aligned security reviews.
• Strong organizational skills with the ability to manage multiple workstreams and deadlines simultaneously.

Preferred

• Relevant certifications such as CompTIA Security+, CEH, GWAPT, or equivalent.
• Experience with ticketing and workflow tools (e.g., Jira, ServiceNow) for tracking remediation.
• Scripting or automation skills (Python, Bash) to support data aggregation and reporting workflows.
• Background in cloud security environments (AWS, Azure, GCP).