Specialist

NTUC First Campus Co-operative Ltd; Singapore; On-site; SGD 90,000 - 120,000; Full time

Job summary

NTUC First Campus Co-operative Ltd is seeking a cybersecurity professional to lead risk assessments, establish risk treatment plans, and support business impact analyses across the organization.

You will maintain risk registers, oversee security testing, conduct vulnerability scanning and pen testing, and collaborate with infrastructure, vendors, and application teams to remediate threats.

Qualifications

• Bachelor's degree in Computer Science, Information Technology, Cybersecurity or a related field.
• Relevant professional certifications such as CISSP, CISM, or CISA are preferred.
• Minimum 3 years of experience in cybersecurity.

Responsibilities

• Perform security risk assessments, formulate and advise on a risk treatment plan, assist the business in performing business impact analysis.
• Maintain cybersecurity risk registers, track remediation actions, and oversee security control testing.
• Review security testing reports and work with application teams for remediation.
• Conduct regular vulnerability scans, penetration testing, and risk assessments across hardware, software, and cloud environments.
• Research emerging cyber threat vectors, vulnerabilities (CVEs), and attacker methodologies to update defensive protocols.
• Collaborate with Infrastructure and End User Support teams to identify and address risks in infrastructure, endpoints, and applications.
• Collaborate with third-party vendors and contractors to ensure security of outsourced systems and services; configure, deploy, maintain critical security infrastructure.
• Support vendor due-diligence and guide third-party risk management efforts.
• Design and lead employee training programs to mitigate phishing, social engineering, and password hygiene.
• Lead the implementation of security protocols and system hardening across enterprise assets.
• Policy & Framework Development: Design, update, and maintain enterprise cybersecurity policies and standards.
• Support cybersecurity operations using enterprise security solutions (PAM onboarding, WAF, firewall rules, Tenable, phishing tools).
• Support internal and external audits (ISO 27001, NIST, OWASP).
• Primary Point of Contact and First Responder for managed services.
• Perform log analysis, investigate and respond to security incidents.
• Collaborate with teams to investigate, contain and remediate security incidents.

Skills

Security governance

Technology risk

Compliance assurance

Vulnerability scanning

Penetration testing

PAM

Firewall management

EDR

WAF

Vendor management

Education

Bachelor's degree in CS/IT/Cybersecurity

CISSP/CISM/CISA certification preferred

Tools

Tenable

Web defacement tools

Firewalls

DLP tools

Antivirus/EDR

WAF

Job description

Key Responsibilities

• Perform security risk assessments, formulate and advise on a risk treatment plan, assist the business in performing business impact analysis,
• Maintain cybersecurity risk registers, track remediation actions, and oversee security control testing.
• Review security testing reports (e.g. vulnerability assessment, penetration testing and secure code review) and work with application teams for remediation.
• Conduct regular vulnerability scans, penetration testing, and risk assessments to identify flaws across hardware, software, and cloud environments.
• Research emerging cyber threat vectors, vulnerabilities (CVEs), and attacker methodologies to update defensive protocols proactively.
• Work closely with Infrastructure and End User Support teams to identify and address any risks and gaps in the infrastructure, endpoints, and application systems
• Collaborate with third-party vendors and contractors to ensure the security of outsourced systems and services meets the industrial best practice to configure, deploy, and maintain critical security infrastructure, including firewalls, antivirus software, data loss prevention (DLP) tools, and regular vulnerability scans.
• Support vendor due-diligence process and help to guide overall third-party risk management efforts.
• Design and lead employee training programs to mitigate human-centric risks like phishing, social engineering, and poor password hygiene (e.g. newsletters, trainings, phishing campaigns)
• Lead the implementation of security protocols, establish robust system hardening standards across enterprise assets, conduct regular risk assessments on hardening control applied.
• Policy & Framework Development: Design, update, and maintain enterprise cybersecurity policies, standards, and control frameworks aligned with business goals
• Support and administer cybersecurity operations using enterprise security solutions (e.g. onboarding of privileged accounts to PAM, implementing WAF for website protection, and reviewing firewall rules, Tenable, Web defacement tools, report phishing tool management, etc.)
• Support both internal audit and external audits (e.g. ISO 27001, NIST, OWASP)
• Primary Point of Contact, and First Responder (monitoring and responding to alerts from Managed Services)
• Perform log analysis, investigate and respond to security incidents, including suspicious activities, phishing attempts, malware infections and data breaches.
• Collaborate with various teams to investigate, contain and remediate security incidents.

Education

• Bachelor's degree in Computer Science, Information Technology, Cybersecurity or a related field
• Relevant professional certifications such as CISSP, CISM, or CISA are preferred.

Experience

• Minimum of 3 years of experience in cybersecurity
• Experience in cybersecurity governance, technology risk, or compliance assurance
• Experience with security technologies such as firewalls, intrusion detection/prevention systems, and data encryption
• Has knowledge in security technologies such as Antivirus/Endpoint Detection and Response (EDR), Privilege Access Management (PAM), Vulnerability Scanning tools, Phishing reporting tools, Web Defacement monitoring tools and Web Application Firewall (WAF)
• Familiarity with security assessment tools and techniques, including vulnerability scanning and penetration testing.
• Experience in vendor and project management

Skills and Attributes

• Excellent communication skills and the ability to explain complex technical concepts to non-technical stakeholders.
• Deep understanding of network infrastructure, TCP/IP protocols, routers, switches, and secure architecture principles.
• Strong analytical and problem-solving skills
• Highly driven and willing to learn