IT Security Officer

Key Responsibilities

Day 1 - Project / Implementation Security

1. Security Implementation & Engineering

• Implement security architecture and controls as designed by Security Leads/Architects
• Support system, application, and infrastructure security configurations
• Assist in threat modelling and risk assessment activities
• Translate security requirements into technical implementation across platforms

2. Compliance Support

• Support compliance with:
• IM8 / Government security policies
• Whole‑of‑Government (WOG) security requirements
• PDPA (where applicable)
• Assist in preparation and documentation for:
• Security Risk Assessments (SRA)
• Vulnerability Assessments (VA)
• Penetration Testing (PT)
• Maintain security documentation and evidence for audits

3. DevSecOps & Secure Development

• Implement and maintain security tools in CI/CD pipelines:
• SAST, DAST, SCA, container scanning
• Monitor and triage findings, and work with developers on remediation
• Support secure coding practices and DevSecOps adoption
• Assist in API security, secrets management, and secure communications setup

4. Security Testing Support

• Support coordination and execution of VA/PT activities
• Track vulnerabilities and ensure timely remediation
• Assist in documenting findings and closure evidence
• Support system security certification and go-live requirements

5. System & Platform Hardening

• Implement and maintain security hardening for:
• Operating systems
• Middleware and databases
• Kubernetes and containers (RBAC, secrets, network policies)

Support configuration of:

• API Gateways
• WAF
• Authentication and authorization mechanisms (OAuth2, mTLS)

Day 2 - Operations / Production Security

1. Incident Response

• Support investigation, containment, and remediation of security incidents
• Perform log analysis and assist in root cause analysis (RCA)
• Work with SOC and internal teams during incidents
• Follow and improve incident response playbooks

2. Vulnerability & Patch Management

• Perform regular vulnerability scans and monitoring
• Track and verify patching and remediation activities
• Escalate high-risk vulnerabilities and propose mitigation controls

3. Security Monitoring

• Monitor alerts from SIEM and security tools
• Assist in tuning detection rules and dashboards
• Ensure logging and monitoring coverage across systems

4. Audit & Compliance Support

• Support audit preparation, evidence collection, and remediation tracking
• Maintain security records and documentation
• Assist in reporting security posture and issues

5. Access Control Administration

Support implementation of:

• RBAC
• MFA
• Privileged Access Management (PAM)
• Perform user access reviews and ensure least privilege

Required Qualifications & Experience

• Degree in Computer Science / Cybersecurity / Information Security or equivalent
• 3-7 years of IT experience in cybersecurity or infrastructure security
• Experience supporting security in projects or production environments
• Familiarity with Singapore Government security policies (IM8 preferred)

Hands-on experience with:

• Kubernetes / Docker security
• IAM and access control
• Security tools (SAST, DAST, SIEM, vulnerability scanners)
• CI/CD and DevSecOps practices
• Basic knowledge of network security, application security, and cloud security

Preferred Certifications

• CEH, CompTIA Security+, or equivalent
• Other certifications (e.g., CISSP Associate, GIAC, AWS/Azure Security) are advantageous