Role Summary
Senior GRC professional who leads security risk, policy compliance and audit support for a Singapore public sector engagement. The role sets the approach, signs off deliverables and is the main GRC contact for the Authority and auditors. The annual workload includes around 10 risk assessments, 5 to 6 audits and one security policy compliance review.
The role also oversees the resilience workstream delivered by the Resilience Specialist.
Key Responsibilities
- Lead security risk assessments from scoping through to final reporting
- Own the risk register and approve risk ratings, findings and recommendations before they go to the Authority
- Lead the annual security policy compliance review and the annual review of security plans
- Act as the main point of contact for auditors and manage audit responses, evidence and findings closure
- Keep all GRC activities aligned with IM8 and Authority security requirements
- Present risk, compliance and audit status in governance meetings and escalate key issues
- Oversee DR and tabletop exercise outcomes and guide the Resilience Specialist
Required Skills and Experience
- Strong working knowledge of Singapore Government IM8 policies and public sector security requirements
- Proven experience leading IT security risk assessments and maintaining risk registers
- Strong understanding of ISO 27001 controls and security policy compliance reviews
- Experience acting as the main contact for internal, external or regulatory audits
- Ability to review system architecture and data flows from a security risk point of view
- Working understanding of BCP and DR governance
Preferred Qualifications
- CISA, CISM, CRISC or CISSP
- ISO/IEC 27001 Lead Auditor
- Prior experience on Singapore Government or public sector engagements
Desired Competencies
- Confident with senior client stakeholders
- Clear, structured report writing
- Sound judgement on risk priorities
- Able to lead workshops and mentor team members