Key Responsibilities Responsible and accountable on a day-to-day basis for information governance work in the Trust. Responsible for ensuring compliance with the NHS Code of Practice, Data Protection Act and Common Law Duty of Confidentiality. Manage and coordinate projects required for implementation of information governance and information security across the Trust. Establish, maintain, and monitor the required security levels for accessing data held on both manual and electronic system records ensuring compliance with Data Protection Act and Caldicott recommendations. Support and advise the Trust's Data Protection Officer with their duties of ensuring that patient and staff rights are protected. Act as the subject matter expert for information governance in supporting the Caldicott Guardian, the SIRO (Senior Information Risk Owner) and Associate Director of Records and Privacy on matters relating to national legislation and best practice. Support the SIRO and Associate Director of Records and Privacy on the development of strategies, policies and guidance to promote and develop best practices as defined by the NHS Data Security and Protection Toolkit (DSPT) and to comply with national legislation. Shape and lead the Trusts Information Governance team, managing the Trusts information governance annual assessment, work programme and action/improvement plans in line with the Trusts information governance strategy and policy and the evolving requirements of the DSPT. Provide information governance advice within the Trust where service developments, changes, or closure of services may impact on compliance to legislation and national policy. Work with other providers, such as health, social services, police etc. to comply with any lawful information governance requirements. Ensure compliance with UK GDPR 2016and Data Protection Act 2018 and any other legal/national requirements. Provide information security and Electronic Patient Record privacy support and advice to the Trust; Lead on ensuring compliance and conformance with the legal and regulatory framework covering information security and privacy and relevant DSPT requirements. Co-ordinate the necessary response and resolution activities following a suspected or actual data security incident or breach. Continuously assess, audit and review, any shortfalls with current security measures compared to the levels required at a policy level thus highlighting deficiencies for remedial action. Provide regular briefings to the Associate Director of Records and Privacy prior to meetings of the Information Governance Steering Group (IGSG) or similar group/board on the effectiveness of information security and privacy functions. Contribute to decision making and carry through decisions made by the IGSG or other relevant group/boards or the Trust Board. Maintain currency with information security and security technologies and coordinate with cyber colleagues as needed to enable measures to be implemented where and when necessary/desirable. Responsible for reporting accurate figures on Information Governance training. This requires a very high level of accuracy to ensure the DSPT target is met. Oversee the Trust compliance with the Freedom of Information Act 2000 so that all FOIA requests are processed within the legal timescales. Provide specialist expert advice and support to the Trusts Senior Information Risk Owner (SIRO) ensuring delivery of the SIROs annual work programme showing compliance with the NHS Digital Information Risk Management standards. Head the IG team with management of IG staff, ensuring budgetary resources are used effectively. Tasks Own the pipeline on Data Protection Impact Assessments (DPIAs) and Data Sharing Agreements (DSAs.) Manage the Information Asset Register. Coordinate engagement with Information Asset Owners ensuring their services and electronic systems are compliant with information governance standards and risk-assessed annually and fed into the Annual Trust Board SIRO assurance statement. Provide ad hoc advice and support on IG and IS matters. Ensures that all staff have appropriate IG training. Escalate to the DPO whenever breaches are discovered. Manage internal Data Protection activities by close liaison with senior clinical and non-clinical colleagues to enable and support both operational and strategic decision-making. Conduct internal audits and privacy reports. Deputise for the Associate Director of Records and Privacy and the Data Protection Officer when necessary. Provide additional support to the AD Records and Privacy / DPO for contact with the Information Commissioners Office and provide advice on complex Data Protection issues, procurement decisions, Information / Cyber Security, and Information Sharing. Coordinate with the Head of Records and the Records Management team leader on common issues. Actively engage with local and regional forums and webinars, ensuring ongoing personal development and knowledge of Data Protection law, issues, and developments. Coordinate and prioritise the work and meetings of the IG Team. Supervise and support staff wellbeing and development in line with the Trusts appraisal policy.

Protect and assure patient data and services against cyber security risk, while enabling secure delivery of new patient services and systems Provide leadership and guidance to the Trust on cyber security policy, risk and compliance issues Provide leadership and support to the Cyber Security Risk Manager and team Deputise for the Head of Information Security when required Develop and drive adoption of the Trusts cyber security strategy, policy, standards and procedures, including policy exception management, in alignment with Trust strategic objectives and with legal and NHS Digital requirements for cyber security and data protection Development of cyber security portfolio, including alignment with clinical and IT strategic objectives and initiatives Partner with business and IT leaders and key decision makers to ensure that appropriate cyber security controls are deployed and operated to time and budget Develop and ensure delivery of the Trust strategic cyber improvement programme, including engagement with NHS Digital and other key partners to drive improvements in cyber capability and maturity Shape commercially acceptable business cases and propositions for Cyber Security investment which balance cyber security risk control with accessibility, usability and cost considerations Lead for providing formal response to cyber security compliance elements of the NHS Digital Data Security & Protection Toolkit Develop and drive adoption of the Trust security risk and assurance framework Lead for embedding cyber risk and assurance controls within development lifecycle for Trust services and systems Provide direction and assurance for cyber security service development and operation, including assurance on cyber security services and systems provided by suppliers Lead the Trust response to major cyber incidents, and on preparatory work for major incidents, including cyber resilience planning and rehearsals Assess and report on cyber security risk posture and compliance through specification and collection of relevant cyber security metrics and KPIs Ensure that the Trust can meet the requirements of national cyber security standards and legislation, including the Data Security & Protection Toolkit, Cyber Essentials Plus, the Data Protection Act (2018) / GDPR and the Directive on the security of Network and Information Systems Monitor and audit Trust processes to identify gaps or weaknesses in current policy and practice, for manual and or electronic systems. Ensure all recommendations are implemented to deliver a continuous improvement in Trust service delivery Agree an annual audit programme with the Trusts Internal Audit department and external auditors. Ensure senior Trust engagement and support for cyber initiatives through regular briefings and reports to senior management boards and forums on cyber risk posture, action planning, and compliance with required standards Provide colleague education and awareness on cyber threat and how to safely respond to cyber incidents As a member of the Trusts senior cyber security team, ensure that cyber security considerations are effectively raised and addressed within appropriate IT and business management forums Set objectives for the Cyber Security Risk team, monitoring performance to assure delivery of the cyber security work programme Develop the skills and foster the career paths for cyber security professionals within the Cyber Risk team. Responsible for overseeing information security systems in place. Reporting on security systems in place and producing reports and audits for relevant governance forums.

Founded in 1988, ALTEN operates in over 25 countries worldwide with ANOTECH Singapore operating since 2015.

To support our growing activitie, ANOTECH Singapore is looking for an Information Security (Cybersecurity and Compliance) to be based in Singapore.

Responsibilities

· Cyber Security risk & compliance officer works cross-departmentally to conduct risk analysis on Projects and Changes in line with Group security strategies.

· Contributes to enhance current risk management process to facilitate collaboration, data collect & sharing between stakeholders

· Ensures that appropriate processes and controls are in place complying with all relevant regulations and legislation

· Assists the organization on implementing Cyber Security Crisis Management Process.

· Actively participate in crisis simulation and update related documentations.

· Conducts internal audits and reviews at regular intervals to ensure that compliance procedures are regularly followed.

· Actively participate in crisis to coordinate, collect, and report operational team activities, suggest improvement, and manage RETEX. Keep documentation up to date and follow improvement plans.

· Ensures that stakeholders are thoroughly updated about the organization’s policies, regulations, and processes.

· Contributes with Technical Direction to answer security questionnaires for Cyber Assurance or customer.

· Participates to audits for customer or certification.

· Make the necessary changes to make our IS more secure and participates in awareness programs implementation for various users and IT teams.

· Produce reports for operational and management teams to assess the effectiveness of security policies in place.

· Propose a tool for crisis management at a Group level (Everbridge…)

Requirements

· Bachelor's Degree in Information Security, Cybersecurity or any relevant discipline

· At least 5 years of working experience

· Demonstrated understanding and experience working within engineering & services companies

· Experience on producing and monitoring operation plan & risk assessment

· Demonstrate abilities in conducting internal quality, compliance audits and reviews

· Excellent written skills and demonstrated ability to prepare professional briefs, summaries, and reports

· Ability to convert complex legislation or information into plain language

· Ability to work autonomously, as part of a team and in co-ordination with other groups

· Communicate and show availabilities in a way remote working doesn’t represent a constraint

· Active listener, Organized

· Fluent English, experience in international and multi-cultural business environment

· French is a plus

· Readiness to travel on needs

Leadership Provide leadership and direction to the information security and business continuity service, including wider directorate and business teams Mentor and coach others, helping to develop our long-term capability including identify capability gaps and solutions Contribute to the development of long-term strategic plans for information security and business continuity, identifying risks and issues and developing mitigation strategies with clear outcome measures.Communicating between the technical and non-technical Identify the needs of business and technical stakeholders. Effectively manage stakeholder expectations. Demonstrate excellent communication skills and can manage difficult conversations or negotiations, including highly complex, sensitive and/or contentious information. Represent information security and business continuity on various internal and external groups.Data protection and freedom of information Support information gathering and creating supporting narrative / recommendations for complex data protection and freedom of information requests. Conduct information system searches and investigations that are highly complex / sensitive in nature, to meet data protection or freedom of information needs. Provide advice and expert knowledge to projects / programmes / operational services to ensure that information systems are designed to meet data protection requirements.Financial management Understand how to balance cost versus value. Consider the impact of user needs. Contribute and develop economic investment cases for information security including financial models for implementation, and running of servicesGovernance and assurance Evolve and define governance. Take responsibility for working with and supporting other staff in wider governance. Assure services across sets of services. Use tools such as standards, guardrails, and principles to effectively govern delivery.Information Security and Business Continuity Demonstrate in-depth knowledge of information security and business continuity, including analysing + testing Trust-wide capabilities and identifying improvement areas. Ensure that our security posture is maintained, monitored/measured and be responsible for leading interventions where standards are not met (example: security patching). Develop, maintain, and improve our data and technology Business Continuity & Disaster Recovery Plans, enabling us to respond to and recover from business continuity events ensuring we can provide a safe level of service to the public during the event, and ensuring we can manage the recovery process and incorporating learning. Lead vulnerability audits, security & penetration tests, forensic audits, or related investigations ensuring all findings are evaluated, and where appropriate, fed into continuous service improvement activities to continuously improve our security posture and resilience. Responsible for ensuring standards around information security and business continuity are embedded into service design. Provide subject matter expertise in major incidents, cyber security incident and/or events caused by or affecting information security. Act as the Problem Owner for highly complex, or sensitive information security matters (from identification through to resolution). Undertake Data Protection Impact Assessment (DPIA) and Information Security Assessment (ISA) activities, including supply chain / 3rd party assessments, aligned with projects / operational services. Maintain and improve the Information Security Assessment lifecycle, and Information Risk Management documentation for IT systems and data. Ensure that access to Trust systems is appropriately managed, regularly audited, and lead investigations as required. Provide expert advice on information transfer agreements with partner organisations in support of the Information Governance function. Partner with the Organisational Development and Information Governance teams and support the delivery of information security awareness and training.Making and informing risk-based decisions Make decisions characterised by managed levels of risk and complexity and recommend decisions as risk and complexity increase. Resolve disputes between wider peers and indirect stakeholders, considering all views and opinions.Policies, procedures, and processes Develop, maintain, and improve all directorate information security and business continuity policies & procedures, considering regional and national policies and practices, ensuring that both manual and electronic information across the Trust is included in-scope. Including, but not limited to DSPT, NIS, ISO / IEC series standards, cyber essentials, etc.Risk management Conduct information security risk assessments and control selection activities. Responsible for the management of information security and business continuity risks (for technology and data), including identifying new risks and ensure we are actively managing risk controls (for your portfolio that you are leading on).Service focus, monitoring, and reporting See the bigger picture and investigate how to get the best out of the underlying services to support the organisations strategic objectives and business priorities. Take complex reporting data from multiple sources, compare, and interpret against service baseline and industry standards and provide a supporting narrative. Responsible for service reporting for information security and business continuity, in-line with Trust-agreed reporting measures (example: security dashboard, security operations centre performance, etc). Ensure we comply with external reporting for information security and business continuity (example: NHS Cyber Alerts).Strategy Apply strategy, using and challenging patterns, standards, policies, roadmaps, and vision statements. You can provide guidance. Evaluate current information security and business continuity strategies to ensure business requirements are being met and exceeded where possible Responsible for managing and updating underpinning / enabling information security strategies that support the business objectives Ensure alignment of operating procedures and policies in-line with national, sector (ICS) and industry best practice where it makes sense to do so.Understanding the whole context Understand trends and practices outside your team and how these will impact your work. See how your work fits into the broader strategy and historical context. Consider the patterns and interactions on a larger scale.User focus Explain the difference between user needs and the desires of the user. Champion user research to focus on all users. Prioritise and define approaches to understand the user story, guiding others in doing so. Offer recommendations on the best tools and methods to use.Community of practice Develop and maintain a network of professionals to enable continuous learning and a community which can share, learn, and keep up to date on the information security and business continuity landscape, within the wider Digital, Data and Technology teams. Other Duties: Deputise for the Head of Information Security & Business Continuity as required. Occasional work may be required outside of core business hours to support major projects / programmes. All other reasonable requests

Hours:

Salary:

£48,050 Per Annum

Closing Date:

Wed, 13 Nov 2024

We are seeking an experienced, skilled and motivated Information Security Specialist to join our dynamic Information Security team. As an Information Security Specialist, you will be responsible for policy development, standards implementation, compliance management, risk management, security testing and promoting positive security culture and behaviours across Skipton Building Society.

About Skipton Building Society

At Skipton Building Society we are not just another Financial Services Institution, we are a mutual organisation, which means we are owned by our members and believe in placing them at the heart of everything we do. The same goes for our people. We can only be successful as a business if we have great people.

We’re committed to creating a diverse and inclusive workplace where every colleague has an opportunity to fulfil their career potential. We respect and appreciate the value that our colleagues’ unique differences can bring and offer consideration for anyone seeking a more flexible work-life balance. Our colleagues say Skipton's a great place to work, and you could be one of them, bringing with you new ideas on how we can keep customers at the heart of what we do.

Whatever your background, and whatever your goals, we'll help you take the next step towards a better future.

What Will You Be Doing?

• Developing, reviewing, and maintaining our information security policies, standards and procedures in alignment with industry and regulatory frameworks such as ISO27001 and NIST.

• Collaborating with stakeholders to ensure policies and standards reflect industry best practices and comply with regulatory requirements.

• Serving as a subject matter expert and trusted advisor on information security, providing guidance and recommendations across the business

• Monitoring and measuring our security control effectiveness based on thorough, scheduled testing throughout the Society.

• Supporting risk assessments and audits to identify areas of non-compliance and providing recommendations for remediation.

• Maintaining and improving our internal vulnerability management schedule.

• Working with our trusted, independent partners to manage scheduled penetration testing of our critical infrastructure and applications.

• Supporting third-party security risk assessments, including due diligence, vendor onboarding, and ongoing monitoring.

• Collaborating with internal teams to provide guidance and support on information security matters, including security behaviours and culture training and incident response.

What Do We Need From You?

Knowledge:

• Proficiency in creating and maintaining information security policies and procedures to a high-quality standard.

• Strong, practical knowledge and experience with ISO27001 and NIST frameworks, including implementation and compliance analysis.

• A good understanding of regulatory requirements, such as GDPR, PRA/FCA, PCI DSS etc.

• Broad and comprehensive knowledge of common information security technologies,tools, and best practices (i.e. Microsoft Azure, Vulnerability Management, Incident Management, Risk Analysis, Security Awareness and Training etc.)

• Understanding of using emerging cyber threats to drive a continuous security improvement program.

Experience:

• A minimum of four years in an information security role or a similar position is required.

• Proven expertise in risk management and responding to cybersecurity incidents.

• Extensive experience with vulnerability management and conducting penetration testing programs, including the use of tools like Qualys or Tenable.

• Demonstrated skill in monitoring and evaluating the effectiveness of security controls against standards.

• Exceptional analytical and problem-solving abilities, capable of assessing risks and formulating practical solutions.

• Experience in creating and implementing a robust security behavior and culture program.

• Prior experience in managing third-party supplier risk is also necessary.

Behaviours:

• Strong written and verbal communication skills with an ability to interact with stakeholders at all levels of the business.

• Motivated, self-directed with the ability to work effectively and efficiently without extensive supervision.

• A creative and proactive approach to continuous learning and professional development.

Qualifications:

• Degree in Cybersecurity, Information Technology or a related field (or equivalent experience)

• Relevant certifications such as CISM, CISSP, ISO27001 Lead Implementer/Auditor or similar

Why Work For Us?

Skipton values work/life balance and we are proud to support hybrid and flexible working, where possible. We have a newly refurbished head office which offers a vibrant and collaborative working space.

We have a range of other benefits available to you including:

• Annual discretionary bonus scheme

• 25 days standard annual leave + bank holidays + rising 1 day per year of service to a maximum of 30 days.

• Holiday trading scheme allowing you to buy and sell additional annual leave days.

• Matching employer pension contribution (up to 10% per annum)

• Colleague mortgage (conditions apply)

• Salary sacrifice scheme for hybrid & electric car

• Private medical insurance for all our colleagues

• 3 paid volunteering days per annum

• A commitment to training and development.

• We care about your health and wellbeing – we provide a range of benefits that support this including cycle to work initiative and discounted gym membership.

• Diverse and inclusive colleague networks available for you to join including our Carers and Pride Alliance groups.

Due to the importance of this vacancy, we will be conducting interviews with suitable candidates before the application closure date. There will be a telephone interview where you get to find out more about the role and then a second stage interview with the hiring team which will be competency based with a choice of presentation.

COMPANY BACKGROUND

Haier is the number one brand of Major Appliances in the world with 16.3 percent of global market share. Headquartered in Qingdao, Haier has over 80,000 employees across 30 countries in the world.

Haier Singapore is the International HQ of Haier Group and is the main platform to provide procurement, trading, R&D and big data and cybersecurity supports to over 80 countries in Asia, Europe, Africa and North America markets.

As the continuous demands from global businesses, we are looking for passionate Information Security Professional to join our Global Information Security team.

KEY RESPONSIBILITIES

Based in Singapore, you will be part of the Global Information Security team, providing Cybersecurity and IT support to Haier businesses in the world.

• Responsible for the construction of Haier's overseas regional information security system, identify issues and risks in security construction and continuously optimize them;
• Establish information security capabilities in various overseas regions, such as endpoint security, data security, application security, vulnerability management, OT security, security operation, etc;
• Responsible for emergency response to information security incidents in overseas regions, quickly resolving problems;
• Responsible for enhancing the information security awareness of employees in overseas regions and developing security training plans;
• Responsible for overseas compliance construction, such as data security compliance, personal privacy compliance, etc., and developing an annual information security audit plan.

KEY REQUIREMENTS

The ideal candidate should be a seasoned information security manager with:

• Degree in Computer Science or its equivalent.
• With minimum of 10 years of work experience and at least of 3 years’ experience in team management.
• Establishment of the ISO27001/NIST/ information security system.
• Proficient in security technologies in various fields, such as endpoint security, vulnerability management, application security, etc.
• Certification in the Information security, risk management, preferably.
• Fluent in Mandarin and English.

Responsibilities

• Performing information risk assessments for new/existing projects, IT outsourcing security reviews, and 3rd party risk assessments as identified across all aspects of the information technology structure.
• Provide security consultations to internal customers by identifying possible security threats and determining the best security measures.
• Communicate security risks and recommendations to technical and non-technical stakeholders.
• risk assessment/application security experience
• Any other ad hoc duties as assigned by supervisor

Qualifications

• Bachelor's degree in Computer Science, Information Security, or a related field.
• Strong knowledge of software development and security practices.
• Familiarity with security standards such as OWASP, PCI DSS, and ISO 27001.
• Certifications in CISSP, CSSLP, OSCP, CISA or CEH.

Interested applicants, please email your resume to Andre Chua Jing Ming

Email: andrechua@recruitexpress.com.sg

CEI Reg No: R1989053

EA Licence No: 99C4599

Recruit Express Pte Ltd

As an Information Security Engineer, you will play a crucial role in our Security Operations Center. Your responsibilities will include monitoring, detecting, investigating, analyzing, and responding to security events within our IT infrastructure, including Operational Technology (OT) systems. Your expertise in cybersecurity frameworks, risk management, and incident response protocols will help fortify our defenses. A thorough understanding of Operational Technology security principles is essential, as you will oversee the integration of security practices in both IT and OT environments to protect our critical infrastructure. You will also apply Scaled Agile Scrum methodologies to coordinate technical meetings and manage security projects efficiently.

Roles and Responsibilities

• Design and implement advanced security architectures for IT and OT environments to ensure robust protection against emerging threats.
• Lead the development and integration of custom security solutions tailored to the specific needs of our digital and physical infrastructures.
• Conduct high-level vulnerability assessments and penetration testing to evaluate the security of IT and OT systems.
• Develop and refine incident response strategies to enhance our ability to respond to and recover from security breaches swiftly and effectively.
• Collaborate with IT and OT teams to ensure seamless integration of security technologies across all platforms.
• Serve as the technical lead on projects involving cybersecurity technologies, ensuring compliance with industry standards and regulatory requirements.
• Mentor junior engineers and analysts, providing guidance on complex technical issues and fostering a culture of technical excellence and innovation.
• Stay current with the latest cybersecurity technologies and trends, applying this knowledge to continuously improve our security posture.
• Prepare and present detailed technical reports and security briefings to senior management, offering strategic recommendations based on your assessments and findings.

Requirements

• A master’s degree in Cybersecurity, Computer Science, Engineering, or a related field, along with significant professional experience in cybersecurity.
• Expertise in designing and managing security solutions for both IT and Operational Technology systems.
• Advanced certifications in cybersecurity such as CISSP, CISM, or GIAC, with specific training in areas like SCADA or ICS security.
• Strong leadership skills with experience in managing complex security projects and leading cross-functional teams.
• Deep understanding of regulatory compliance and security frameworks such as ISO 27001, NIST, SOC 2, and others relevant to IT and OT cybersecurity.

Interested candidates, who wish to apply for the advertised position, please email us an updated copy of your resume.

We regret that only shortlisted candidates will be notified.

EA License No.: 01C4394

By sending us your personal data and curriculum vitae (CV), you are deemed to consent to PERSOLKELLY Singapore Pte Ltd and its affiliates to collect, use and disclose your personal data for the purposes set out in the Privacy Policy available at https://www.persolkelly.com.sg/policies. You acknowledge that you have read, understood, and agree with the Privacy Policy

Our client’s success is our success. And you make it happen! 

Payment systems are complex, regulated and everchanging. We are an established market leading brand who are focused on driving client growth. We’re at the forefront of innovation punching above our weight. We’re enabling the future for our clients through innovative technology like the New Payments Platform (NPP) and open banking.    

We are an unlisted public company and one of five licensed banks in Australia with full direct connectivity and production capability across all domestic payment systems. Whilst the major banks leverage this capability for their consumer and business clients, our B2B model focuses on enabling other banks, fintech’s and corporates to deliver innovative and competitive payment and digital solutions to their clients and customers. 

We are looking for an Information Security Risk Management Lead in our Group Risk and Compliance Team.  

Reporting to the Head of Operational Risk and Compliance, the Information Security Risk Management Lead is responsible for technology risk advisory, review/challenge, oversight and monitoring over information security and data risk frameworks and how it is operationalised. 

This is a highly visible role in the business ensuring technology risks are effectively identified, assessed, managed and monitored across Cuscal. Responsibilities of the Information Security Risk Management Lead in the team’s capacity as the second line of defence under the Risk Management Framework fall into four key areas: 

1) Technology Risk Management Framework Advisory, Oversight and Monitoring 

• Ensure Information Security Risks (technology and cyber) and Data risks are adequately managed through Cuscal’s frameworks in line with regulatory requirements (e.g. CPS 234,230, CPG 235 etc.), industry best practices and operating environment in line with three lines of defence   
• Ensure line 2 risk management capability is built and sustained to review, challenge, oversight and assurance reinforcing and maturing line 1 accountability with the business owners   
• Work collaboratively with Product domains, Engineering and corporate functions to embed technology risk management practices into everyday activities, embed controls, and monitor/report on issues.  
• Foster a risk culture that promotes open communication, transparency, and ownership of risk at all levels of the organisation  
• Risk Reporting & Analytics: Provide insights derived from technology and data risk reporting to the Board and Executive Leadership Team 

2) 2nd Line Review, Challenge and Oversight 

• Review and challenge risk/RiC assessments, adequacy and effectiveness of risk mitigation strategies, controls, and action plans implemented by 1st line teams.   
• Critically assess incidents, breaches, and near misses to identify systemic issues and recommend appropriate remediation actions.  
• Ensure the continuous improvement of risk management practices by engaging with business units to provide constructive feedback and challenge assumptions.   
• Act as a trusted advisor to senior leadership and business units on operational risk matters, including emerging risks, regulatory changes, and industry trends.   
• Drive education and training programs to elevate operational risk awareness and capabilities across the organisation.   
• Collaborate with product, client, and technology teams to ensure operational risk considerations are integrated into new initiatives, system changes, and major projects.   
• Line 2 support for assessments of third-party technology risks and controls. 

3) Emerging Risks and Innovation 

• Stay informed about the latest developments in AI and other emerging technologies to proactively identify potential risks. Support Cuscal teams in rapidly adopting new technologies in a safe and controlled manner. 
• Review/provide oversight over initiatives to automate technology risk & controls monitoring processes using advanced tools and technologies.  
•  Promote a culture of innovation in risk management practices, encouraging the adoption of new approaches and technologies. 

4) Stakeholder Engagement 

• Work closely with internal and external stakeholders as required, to ensure a cohesive approach to technology risk management.  
• Develop and deliver training programs to enhance technology risk awareness and competency across Cuscal.  
• Promote and drive a positive risk culture to lift overall risk management maturity across Cuscal.   

About You 
To be successful in this position you will have the following skills and experience: 

• Bachelor’s degree in information technology, Information Systems, Risk Management, Cybersecurity, Computer Engineering, or a related field. Relevant certifications (e.g., CRISC, CISA, CISSP) are desirable. 
• Minimum of 4-6 years of experience in technology risk management within the financial services industry. 
• Strong knowledge of risk management and IT frameworks and standards such as ITIL, ISO 27001, NIST, COBIT, and relevant APRA guidelines (CPS234, CPG235, CPS230, CPS220) 
• Demonstrated experience in managing risks associated with AI, machine learning, and other emerging technologies. 
• Prior experiencing leading risk maturity uplift at another organisation within a function, business unit or risk class. 
• Strong project management skills, including planning, execution, and stakeholder management. 

What’s it like to work here? 

As well as good pay and a great culture, we back our employees by helping them work towards industry-recognised qualifications, using online learning, training modules and career planning tools for you to grow with us. We are committed to providing a diverse and inclusive workplace where the very best talent in Australia chooses to work. We support our colleagues with flexible work arrangements through our hybrid model whilst also offering a wide range of financial, lifestyle, health & wellbeing benefits. 

 
Next Step 
If you think this role is the right fit for you, we invite you to apply. Let’s explore who you are and what drives you. We’d love to share our vision for the future of payments sector. Please note candidate screening and interviews may be conducted prior to the closing date of the job advert. 
   
Cuscal does not accept unsolicited resumes from recruitment agencies and search firms. Please do not email or send unsolicited resumes to any Cuscal employee, location or address. 

MAJOR DUTIES: This is NOT an all-inclusive list.

• Initiates and implements policies and procedures required to manage sensitive compartmented information (SCI) programs and to protect SCI resources.
• Acts as resident expert on all SCI security matters.
• Functions as the technical authority in all other areas of classified security and classification guidance.
• Establishes policies and procedures for accomplishment of SCI protection and security.
• Researches, interprets, analyzes and applies Presidential Executive Orders, Director Central Intelligence Directives (DCIDs), Defense Intelligence Agency Manuals, DoD Manuals, Army / Air Force Manuals, Army Regulations / Air Force Instructions, and local Operating Instructions.
• Serves as the SCI Control Officer responsible for establishing, managing, and controlling all collateral and SCI classified information and material within the Sensitive Compartmented Information Facilities (SCIFs) affecting the Unit's mission.
• Ensures SCIFs comply with all applicable construction and physical requirements, standards, and regulations as delineated by higher headquarters.
• Works directly for the intelligence unit commander/Senior Intelligence Officer (SIO), reporting on the administration of the Special Security Office and SCI-associated security programs.
• Serves as the principal advisor to the intelligence unit commander/SIO on SCI, physical, computer, information, personnel, and administrative security.
• Manages and directs the activities and personnel of the unit Special Security Office.
• Plans and supervises work accomplished by assigned subordinates.
• Sets and adjusts short-term priorities and prepares schedules based on organization priorities and missions
• Appoints Local SCI courier officials that have a requirement to courier SCI on base and coordinates with the Defense Courier Service (DCS).
• Administers the SCI security clearance program for all assigned personnel, ensuring all required clearances are up-to-date and completed.
• Terminates or transfers SCI clearances for out-processing personnel.
• Provides oversight of unit and SSO security self-inspections and presents detailed and comprehensive reports with corrective action taken to the unit intelligence commander/SIO.
• Follows-up to ensure complete and quality resolution of discrepancies.
• Represents the intelligence unit to a variety of installation and functional areas, including national-level organizations.
• Interfaces directly with DoD, Defense Intelligence Agency, National Security Agency, Defense Intelligence Agency, US Army, US Air Force, Air Intelligence Agency, major commands, combatant commands, and other national-level agencies to evaluate, guide, and adjust unit programs to meet changing security needs and requirements as personally assessed or as directed.
• Performs other duties as assigned.

Starting at $72,553 Per Year (GS 11)

MAJOR DUTIES: This is NOT an all-inclusive list.

• Initiates and implements policies and procedures required to manage sensitive compartmented information (SCI) programs and to protect SCI resources.
• Acts as resident expert on all SCI security matters.
• Functions as the technical authority in all other areas of classified security and classification guidance.
• Establishes policies and procedures for accomplishment of SCI protection and security.
• Researches, interprets, analyzes and applies Presidential Executive Orders, Director Central Intelligence Directives (DCIDs), Defense Intelligence Agency Manuals, DoD Manuals, Army / Air Force Manuals, Army Regulations / Air Force Instructions, and local Operating Instructions.
• Serves as the SCI Control Officer responsible for establishing, managing, and controlling all collateral and SCI classified information and material within the Sensitive Compartmented Information Facilities (SCIFs) affecting the Unit's mission.
• Ensures SCIFs comply with all applicable construction and physical requirements, standards, and regulations as delineated by higher headquarters.
• Works directly for the intelligence unit commander/Senior Intelligence Officer (SIO), reporting on the administration of the Special Security Office and SCI-associated security programs.
• Serves as the principal advisor to the intelligence unit commander/SIO on SCI, physical, computer, information, personnel, and administrative security.
• Manages and directs the activities and personnel of the unit Special Security Office.
• Plans and supervises work accomplished by assigned subordinates.
• Sets and adjusts short-term priorities and prepares schedules based on organization priorities and missions
• Appoints Local SCI courier officials that have a requirement to courier SCI on base and coordinates with the Defense Courier Service (DCS).
• Administers the SCI security clearance program for all assigned personnel, ensuring all required clearances are up-to-date and completed.
• Terminates or transfers SCI clearances for out-processing personnel.
• Provides oversight of unit and SSO security self-inspections and presents detailed and comprehensive reports with corrective action taken to the unit intelligence commander/SIO.
• Follows-up to ensure complete and quality resolution of discrepancies.
• Represents the intelligence unit to a variety of installation and functional areas, including national-level organizations.
• Interfaces directly with DoD, Defense Intelligence Agency, National Security Agency, Defense Intelligence Agency, US Army, US Air Force, Air Intelligence Agency, major commands, combatant commands, and other national-level agencies to evaluate, guide, and adjust unit programs to meet changing security needs and requirements as personally assessed or as directed.
• Performs other duties as assigned.

Starting at $72,553 Per Year (GS 11)

• Data Privacy Professional, with strong hands-on experience in EU & UK GDPR, POPIA, CCPA and relevant regulations.
• Manage and improve data privacy policies, standards, guidelines, and procedures to ensure the ongoing improvement and maintenance of privacy in line with applicable data privacy and protection standards & regulations such as GDPR
• Develop, supervise, and improve all data privacy measures and controls that are in place within the company
• Establishing appropriate levels of privacy controls, performance monitoring, and audits of the controls
• Planning and conducting data privacy related internal audits to assess compliance with the data privacy and protection framework.
• Work with an external auditing agency to plan, facilitate and manage external data privacy audits
• Train relevant stakeholders on data privacy and protection best practices
• Maintain an up-to-date record of all personal data processing activities
• Support client-driven privacy audits and due diligence
• Conduct third party risk management in the context of data privacy.
• Work with the development and support team to support CCPA, GDPR and POPIA compliance-related activities for our web platforms
• Hands-on experience with privacy regulations and standards like EU & UK GDPR, PECR, CCPA, ISO 27701
• Hands-on experience in managing and driving data privacy compliance mainly GDPR, POPIA and CCPA
• Hands-on experience with privacy regulations and standards like EU & UK GDPR, PECR, CCPA, ISO 27701
• Hands-on experience in managing and driving data privacy compliance mainly GDPR, PECR and CCPA

Responsibilities

• Performing information risk assessments for new/existing projects, IT outsourcing security reviews, and 3rd party risk assessments as identified across all aspects of the information technology structure.
• Provide security consultations to internal customers by identifying possible security threats and determining the best security measures.
• Communicate security risks and recommendations to technical and non-technical stakeholders.
• risk assessment/application security experience
• Any other ad hoc duties as assigned by supervisor

Qualifications

• Bachelor's degree in Computer Science, Information Security, or a related field.
• Strong knowledge of software development and security practices.
• Familiarity with security standards such as OWASP, PCI DSS, and ISO 27001.
• Certifications in CISSP, CSSLP, OSCP, CISA or CEH.

Interested applicants, please email your resume to Andre Chua Jing Ming

Email: andrechua@recruitexpress.com.sg

CEI Reg No: R1989053

EA Licence No: 99C4599

Recruit Express Pte Ltd

Lico Resources, the specialist executive search firm, is partnering a leading financial institution in searching for an Information Technology Risk Management Professional. The institution is a key player in the finance sector, and is dedicated to fostering a secure and technologically advanced environment for its clients. they are seeking a dynamic professional to join their existing team in Singapore.

This role involves collaborating with internal and external teams to assess risks, implement effective security measures, and ensure the overall robustness of the technology landscape.

Key Responsibilities:

• Conduct comprehensive risk assessments for the firm's IT systems, applications, and processes.
• Develop, implement, and enforce risk management policies, procedures, and controls to mitigate potential threats.
• Collaborate with cross-functional teams to identify and address emerging risks associated with technological advancements.
• Monitor and analyze security incidents, providing timely response and remediation strategies.
• Stay abreast of industry trends, emerging threats, and best practices to enhance the firm's risk management capabilities.
• Communicate effectively with stakeholders, including IT teams, senior management, and regulatory bodies.

Qualifications:

• Bachelor's degree in Information Technology, Computer Science, or a related field.
• Minimum of 5 years of experience in information technology risk management, with a preference for candidates with financial services industry experience.
• Strong understanding of information security frameworks, risk assessment methodologies, and regulatory requirements.
• Familiar with related regulations such as Technology Risk Management Guideline, CCoP2 Risk Management Practices, Guideline on Business Continuity Management, Guideline on Outsourcing and other relevant notices and guidelines
• Familiarity with industry frameworks and methodologies for technology risk management, such as NIST Cybersecurity Framework, ITIL, ISO 27001, and COBIT. Professional certifications such as CISA (Certified Information Systems Auditor), CISM (Certified Information Security Manager), or CRISC (Certified in Risk and Information Systems Control) are advantageous.
• Experience with risk assessment tools and technologies.
• Excellent communication skills, both written and verbal.

If you are interested in this role, please send us your updated resume today to nicole@licoresources.com quoting reference number A09478 Please note that only shortlisted candidates will be notified.

“Data provided is for recruitment purposes only.”

Job Reference No: A07415 EA Licence No.: 13C6733 EA Registration No.: R1333454

Job’s mission

Under the direct supervision and guidance of the Global Head of Information Security, the job holder is part of the Global Information Security (Digital & IT Division), responsible for leading the implementation & execution of Global Cyber Defense Strategy, implementation of technical solutions to defend Santen from cyberattacks, running risk assessments of all new global solutions, managing the risk and vulnerability management process (both Information Systems and Industrial Control Systems), developing and maintaining the organization's security architecture, while considering investor's expectation for company security measures such as security regulations, standards and best practice, working with SOC (Security Operations Center) partner in order to ensure that information assets are adequately protected and compliant as well as maximize the benefit of information systems for Santen’s global businesses.

 

Number of direct subordinates

There might be direct reports soon, and several Digital & IT members and external consultants whose activities need to be coordinated by this role within the framework of cybersecurity projects or processes.

 

 

Key Responsibilities & Accountabilities

 

Cybersecurity Defense & Management

• According to the company’s long-term vision, formulate and integrate cybersecurity strategies into a companywide strategic plan by collaborating with cross-functional teams to design and implement secure infrastructure and application solutions
• Understand expectations of the company regarding continuous growth, establish concrete goals, and create mid-term strategies to achieve goals
• Drive the Global Cyber Defense Strategy, maintain ready forces and capabilities to conduct cybersecurity operations
• Anticipate future internal and external trends and implications and create appropriate cybersecurity measures
• Build understanding of cyber threats in each level. Develop detection & protection measures continuously, lead the technical solution implementations to be prepared to defend Santen from disruptive or destructive cyberattacks

 

Security Incident Management

• Ensure the security incident management process are executed properly by all parties by tracking the resolution process and making sure the known issues are addressed according to risk management methodology
• Lead the monthly operational meetings between SOC team and Santen, improve the overall process and ensure the KPIs are achieved
• Verify and continuously improve the Recovery Process performed during or after a security incident to ensure that it meets business requirements and is effective and practical
• Manage the Major Security Incident Management process, under Global Head of Information Security, and guide/train different stakeholders, including SOC team, DIT leaders and technical managers
• Support the Disaster Recovery and Business Continuity framework, initiatives, and execution

 

Technical Risk Management

• Improve Santen’s cybersecurity maturity level by increasing overall awareness and providing security advice/insights on technical requirements to DIT and non-DIT leaders (both Information Systems and Industrial Control Systems global leaders)
• Lead global programs & project implementations, planning the delivery of risk mitigation solutions and answering technical questions, reviewing current security measures, recommending enhancements, and identifying areas of security weakness
• Perform technical risk assessments (IT & OT) of all new global solutions and third parties, identify potential gaps and make sound recommendations for mitigating the risks on a global scale
• Implement the Internal Cybersecurity Framework to support the state-of-art technologies and Santen regulatory and organizational requirements (ISO 27001, NIST, Data Privacy Laws)

 

Vulnerability Management

• Implement and improve the Global Vulnerability Management Program focused on reducing the risk presented by vulnerabilities in Santen environment by continuously performing three core steps: Discovery, Reporting and Remediation
• Guide the technical teams (Global IT Infra, Regional IT Infra and Application teams, critical third parties) to make sure vulnerabilities are mitigated on a timely manner, perform the escalations on time
• Manage the global vulnerability scan and penetration test exercises
• Manage the relationship and contracts with the external suppliers to obtain the best value for Santen

 

Threat Intelligence

• Determine the need for covering the risks on company’s threat landscape and continuously search for the most strategic product & services to deliver the needed capabilities
• Keep track of changes in Santen’s business, threat landscape, product innovations and rebalance according to the risk appetite
• Build and maintain robust partnerships with market leaders (e.g. Gartner, ISF) to deter shared threats in our industry
• Build close partnerships and implement efficient internal processes with business and technical teams to detect and mitigate threats before they can be exploited

 

Project Initiation and Execution

• Lead projects to implement new cybersecurity solutions or frameworks by developing business cases or conducting opportunity studies when needed
• Understand projects and services specificities in a multi locations environment with many remote management situations
• Ensure there are continuous PDCA (Plan, Do, Check and Action) cycles to improve services and solution in place in relations with KPIs/SLAs in place or to be developed

 

Stakeholder Relationship and Vendor Management

• Maintain good working relationships with internal stakeholders globally, especially with Digital & IT management
• Support his/her Digital & IT peers in charge of infrastructure, service operations and business applications to provide the right information security advice or solutions allowing them to provide the contributions to business domains
• Manage the suppliers by defining clear guidelines and objectives, relying on KPIs in coordination with the governance in place. Challenge organization and governance in place to verify the company is obtaining best value and that vendors are meeting our information security needs and requirements

 

Resources Management

• Develop and own the budget proposal for the cybersecurity domain in accordance with the company guidance on budget directions
• Ensure financial governance and efficient use of resources to meet business objectives.
• Execute the budget in respect of its objectives in terms of services to operate, solutions to deliver

• Perform ongoing security maturity level assessment to evaluate the effectiveness of security controls and explain the effectiveness to project teams, business stakeholders and senior management