IT Security Manager

The IT Security Manager is the customer-facing security lead and trusted advisor for the applications and AI-enabled solutions we deliver, accountable for their overall IT security posture. Working closely with customers, project teams and independent security partners, you will coordinate threat modelling, risk assessments, security testing and audits, with the technical depth to assess specialist work and act on the results. This role goes beyond back-office compliance – you will help shape how security supports innovation and strong governance in high-security, regulated environments.

What You'll Own

1. Customer Security Leadership
   • Serve as the primary security contact and trusted advisor, liaising between customers, delivery teams and independent security partners.
   • Report security status and risks to customers and management, with overall accountability for the IT security of delivered systems.
2. Security Planning & Partner Oversight
   • Plan and coordinate security activities across the project lifecycle, including threat modelling, risk assessments, security testing and audits.
   • Assess the quality and accuracy of work produced by independent security partners, such as threat models and test reports, and follow up on gaps.
     
3. Risk Management & Documentation
   • Conduct IT security risk assessments jointly with customers, propose mitigation measures for approval, and maintain the risk register.
   • Prepare and maintain security documentation, including security plans, design documents, policies and procedures.
4. Secure Design & Standards
   • Ensure systems meet customer-approved security requirements and recognised standards, from design through testing.
   • Advise delivery teams on secure design for cloud-first and AI-enabled solutions.
5. Remediation & Incident Response
   • Consolidate findings from security assessments and testing, and drive their timely remediation and closure.
   • Coordinate security incident handling and act as the primary point of contact for security escalations.

What You'll Bring

Must-Have

• At least 5 years of experience in IT security, covering enterprise systems, networks or cloud infrastructure.
• Experience in security risk assessment, security governance, incident response, vulnerability assessment and security testing.
• Sound technical knowledge of application, infrastructure and cloud security, enough to evaluate threat models, assessment reports and test results.
• Experience coordinating with customers, vendors and third-party security providers.
• Good knowledge of security standards and best practices such as ISO/IEC 27001, NIST and CIS.
• A current professional security certification such as CISSP, CISM, CCSP, CISA or CRISC.
• Strong written, presentation and stakeholder management skills.
• Able to support security incident response outside office hours when required.

Good-to-Have

• Exposure to DevSecOps practices and the security of AI-enabled solutions.
• Prior experience in a similar role in the Singapore Public Sector, including familiarity with government ICT security policies.

Not for You If

This role is not a fit if:

• You prefer back-office compliance work rather than being customer-facing on live delivery.
• You want a purely hands-on testing role rather than coordinating and assessing the work of specialist partners.
• You see security as a gate that slows delivery rather than something that enables it.
• You're uncomfortable being the primary point of contact for security escalations, including outside office hours