Security Analyst

Rapsys Technologies Pte Ltd.; Singapore; On-site; SGD 60,000 - 100,000; Full time

Job summary

Rapsys Technologies Pte Ltd. is seeking a Security Analyst to own the end-to-end vulnerability management lifecycle, from intake to closure, with emphasis on triage, scoring, and remediation tracking.

You will coordinate quarterly assessments and annual penetration tests, ensuring timely remediation with clear documentation. The role requires 2+ years in information security, hands-on scanning tool experience (Tenable/Qualys/Rapid7/Wiz), and strong ability to communicate risk to technical and

Qualifications

• 2+ years of experience in information security, vulnerability management, or related role.
• Hands-on experience with vulnerability scanning platforms (e.g., Tenable, Qualys, Rapid7, Wiz).
• Solid understanding of CVSS scoring, vulnerability classification, and risk-based prioritization.
• Experience communicating security findings and risk to both technical teams and business stakeholders.
• Familiarity with common compliance and risk frameworks (e.g., NIST CSF, ISO 27001, SOC 2).
• Familiarity with GovTech's IM8 policies and its risk-based assessment methodology, including controls, classification, and IM8-aligned reviews.
• Strong organizational skills with the ability to manage multiple workstreams and deadlines.

Responsibilities

• Own and manage the end-to-end Vulnerability Management process, including intake, triage, and lifecycle tracking of security findings across the organization's systems and assets.
• Classify vulnerabilities by severity, exploitability, and business impact using CVSS, EPSS, and internal risk criteria.
• Plan, coordinate, and manage Quarterly Vulnerability Assessments with scoping targets and scanning tools, driving findings to resolution.
• Manage the Yearly Penetration Testing cycle—scoping, vendor coordination, findings review, and remediation tracking.
• Track remediation end-to-end, ensuring documentation and sign-off at each step.
• Coordinate with remediation teams to ensure timely resolution and provide prioritization guidance.
• Maintain risk acceptance records with approvals and reviews.
• Track and report on remediation SLAs and escalate high-risk items.
• Produce status reports and dashboards communicating security posture to technical and non-technical audiences.
• Aggregate vulnerability data from multiple tools into a unified risk view.
• Develop metrics and KPIs for leadership visibility and program effectiveness.
• Present findings and recommendations in reports and executive briefings.
• Act as liaison between security and remediation owners to remove blockers.
• Improve vulnerability workflows, tooling, and documentation.
• Support audit and compliance with evidence of tracking and risk treatment.
• Contribute to threat intelligence and stay current on CVEs and attack trends relevant to the organization.

Skills

Vulnerability management

Risk assessment

Stakeholder communication

Project coordination

Tools

Tenable

Qualys

Rapid7

Wiz

Jira

ServiceNow

Job description

We're Hiring: Security Analyst!

Location: Singapore, Singapore
Work Mode: Work from Office
Role: Security Analyst

Key Responsibilities

• Own and manage the end-to-end Vulnerability Management process, including intake, triage, and lifecycle tracking of security findings across the organization's systems and assets.
• Classify vulnerabilities by severity, exploitability, and business impact using frameworks such as CVSS, EPSS, and internal risk criteria.
• Plan, coordinate, and manage Quarterly Vulnerability Assessments — scoping targets, engaging scanning tools, reviewing outputs, and driving findings through to resolution.
• Manage the Yearly Penetration Testing cycle, including scoping, vendor coordination, findings review, and tracking remediation commitments through to closure.
• Track key remediation implementations end-to-end, maintaining visibility from initial detection through to verified closure — for example, overseeing the transition of WAF rules from detection mode to prevention mode, ensuring each step is documented, tested, and signed off.
• Coordinate with remediation teams (engineering, DevOps, infrastructure) to ensure timely resolution of findings, providing clear context and prioritization guidance.
• Maintain and update risk acceptance records, ensuring appropriate approvals are obtained, documented, and reviewed on schedule.
• Track and report on remediation SLAs, escalating overdue or high-risk items to the appropriate stakeholders.
• Produce regular status reports and dashboards that communicate the project's overall security posture to technical and non-technical audiences.

Security Visibility & Reporting

• Aggregate vulnerability data from multiple scanning tools and sources into a coherent, unified view of security risk.
• Develop and maintain metrics and KPIs that enable leadership visibility into ongoing security exposure and program effectiveness.
• Present findings, trends, and recommendations in written reports, executive briefings, and team meetings.

Collaboration & Process Improvement

• Act as a liaison between the security team and remediation owners, facilitating communication and removing blockers to resolution.
• Continuously improve vulnerability management workflows, tooling, and documentation.
• Support audit and compliance activities by providing evidence of vulnerability tracking and risk treatment processes.
• Contribute to threat intelligence efforts and stay current on emerging CVEs and attack trends relevant to the organization.

Qualifications Required

• 2+ years of experience in an information security, vulnerability management, or related role.
• Hands-on experience with vulnerability scanning platforms (e.g., Tenable, Qualys, Rapid7, Wiz, or similar).
• Solid understanding of CVSS scoring, vulnerability classification, and risk-based prioritization.
• Experience communicating security findings and risk to both technical teams and business stakeholders.
• Familiarity with common compliance and risk frameworks (e.g., NIST CSF, ISO 27001, SOC 2).
• Familiarity with GovTech's IM8 (Instruction Manual 8) policies and its associated risk-based assessment methodology, including the application of controls, classification of government ICT systems, and conducting or supporting IM8-aligned security reviews.
• Strong organizational skills with the ability to manage multiple workstreams and deadlines simultaneously.

Preferred

• Relevant certifications such as CompTIA Security+, CEH, GWAPT, or equivalent.
• Experience with ticketing and workflow tools (e.g., Jira, ServiceNow) for tracking remediation.
• Scripting or automation skills (Python, Bash) to support data aggregation and reporting workflows.
• Background in cloud security environments (AWS, Azure, GCP).