Senior Assistant Director (GCS-Dev/Government/Healthcare), CCT

Cyber Security Agency of Singapore (CSA); Singapore; On-site; SGD 180,000 - 260,000; Full time

Job summary

The Cyber Security Agency of Singapore (CSA) invites a senior cybersecurity consultant to join one of its pillars including Government Central Systems Development (GCS-Dev), Government and Healthcare. You will lead a team of directors, senior consultants and engineers to provide consultancy through risk assessment, security design reviews and validation of security testing.

You will shape security architectures and mentor the team.

Qualifications

• Bachelor degree in ICT-related discipline or Engineering
• Professional cybersecurity qualifications such as CISSP, CISA or CRISC
• Extensive supervisory experience (15-20 years)
• Strong interest and hands-on understanding of cybersecurity
• Excellent stakeholder management and communication skills
• Ability to work independently and in a team
• Knowledge of risk assessment, security design review and security testing

Responsibilities

• Lead a team of directors, consultants and engineers to provide cybersecurity consultancy.
• Perform risk assessments for Government/Healthcare ICT systems and justify residual risk levels.
• Review and propose security designs, mitigation controls and testing plans.
• Collaborate with system owners and project teams to identify threats and risks.
• Review third-party security testing proposals and ensure comprehensive test coverage.
• Develop security reference architectures and threat reference models.
• Manage team capability development and training plans.
• Coordinate with stakeholders to enforce approved reference architectures and models.

Skills

Analytical thinking

Stakeholder management

Communication skills

Independent worker

Team leadership

Education

Bachelor's degree in Information Technology / Cybersecurity / Computer Science

Professional qualifications (CISSP, SANS, CISA, CRISC)

Job description

The successful candidate will be assigned to work in one of the various pillars in the division such as "Government Central Systems Development (GCS-Dev)", "Government" and "Healthcare". Lead a team of assistant directors, senior consultants, consultants and system engineers to provide cybersecurity consultancy through evaluating the risk assessment, security design review and plan and review security testing of GCS-Dev / Government/ Healthcare so as to ensure that the Systems are well protected while System owner accepts justifiable risk levels.
Responsibilities:

• Perform the risk assessment for GCS-Dev/ Government/ Healthcare to ensure it is well protected and justify the risks to the System owner for risk acceptance
• Collaborate with system owners and project team to understand the business and system requirements so that you can analyse and identify the cyber and physical threats and formulate the relevant project-specific scenarios and potential risks
• Propose people, process and technology (PPT) cybersecurity mitigation controls on the completed TRA Template and project-specific scenarios
• Justify the residual risks level for acceptance and approval by the designated approving authority
• Review the security design of GCS-Dev/ Government/ Healthcare ICT systems to identify areas of weaknesses and recommend security solution or controls to mitigate against highlighted threats
• Identify, assess and review cybersecurity solutions to secure ICT networks and systems
• Collaborate with system owners and project team to review and provide advice on the final proposed security design and mitigation controls
• Collaborate with system owners and project team to identify additional risks due to deviations in the final proposed security design and propose mitigation controls
• Review security testing scopes and plans that validate and verify the security design of the GCS (Dev) / Government/ Healthcare ICT Systems
• Review vendor's system security testing proposals and Penetration Test (PT) plans, and if needed, insert or counter propose test plans and test cases to make sure the security testing is comprehensive
• Review and provide advice to system owners and project team on the conduct of system security testing and PT
• Serves as controller to verify the execution of the system security testing and PT
• Assess and provide advice, identify risks and propose remediation measures on the findings and recommendations from the system security testing and PT reports
• Optimise cybersecurity consultancy practices for effectiveness and efficiency of GCS-Dev/ Government/ Healthcare systems
• Develop security reference architectures and threat reference models to optimise consultancy effectiveness and efficiencies
• Work with team members to develop, operate and publish the security reference architectures and threat reference models
• Enforce approved security reference architecture and threat reference models during cybersecurity consultancy
• Analyse lessons learned from consultancy works and incorporate areas of improvement to enhance Consultancy Models, security reference architecture and threat reference models
• Manage Team Capability Development
• Managed Team esprit de corps, professional and personal developments
• Develop training plans for the team based on competency framework i.e. RTEC (Raise + Train + Evaluate = Capability) Framework
• Identify suitable training programmes/events/seminars for each team role to associate the required capability in dealing with ever-changing cybersecurity threats landscape
• Monitor training budget allocated and provide updates to management when required
• Establish processes for Knowledge Management for purpose of cybersecurity consultancy knowledge sharing and retention

Requirements

• Bachelor Degree in Information Communication Technology-related discipline (Cybersecurity, Information Security, Information Technology, Computer Science, Management Information Systems), Science or Engineering etc
• Professional qualifications such as CISSP, SANS, CISA, CRISC or equivalent
• At least 15 to 20 years relevant working experience and more than 10 years of supervisory experience to manage, work and collaborate with various parties including stakeholders, system owners, teammates and contractors
• Good understanding and interest in Cybersecurity
• Technically hands-on and curious about inner workings of technology
• Strong analytical and conceptualisation skills
• Good communications and interpersonal relationship skills, stakeholder management
• Driven and capable to work independently. Resourceful, responsible, motivated and able to work independently as well as in a team