IT Security Manager

The IT Security Manager is the customer-facing security lead and trusted advisor for the applications we deliver, working with customers, project teams and independent security partners. You will direct threat modelling, risk assessments, security testing and audits, with the technical depth to assess partners' work and act on the results.
This is a demanding role. Our public sector customers expect strict adherence to process and tender specifications, and discussions can be challenging. We want someone who holds the line on compliance and quality, stays composed under pressure and builds trust through reliable delivery.

What You'll Own

1. Customer Security Leadership
   • Be the primary security contact for customers, delivery teams and independent security partners, including incident handling and escalations.
   • Report security status and risks to customers and management, with overall accountability for the IT security of delivered systems.
2. Security Planning & Partner Oversight
   • Plan and coordinate threat modelling, risk assessments, security testing and audits across the project lifecycle.
   • Conduct risk assessments jointly with customers, propose mitigations for approval and maintain the risk register.
3. Secure Design & Standards
   • Prepare security documentation, and ensure systems meet customer-approved requirements and recognised standards, from design through testing.
   • Advise delivery teams on secure design for cloud-first and AI-enabled solutions.
4. Secure Design & Standards
   • Prepare security documentation, and ensure systems meet customer-approved requirements and recognised standards, from design through testing.
   • Advise delivery teams on secure design for cloud-first and AI-enabled solutions.
5. Compliance & Stakeholder Management
   • Ensure delivery adheres strictly to tender specifications, contractual requirements and agreed processes, with audit-ready evidence.
   • Manage demanding stakeholders calmly and courteously: clarify requirements in writing, hold firm on agreed scope and standards, and escalate early.

What You'll Bring

Must-Have

• At least 5 years of experience in IT security across enterprise systems, networks or cloud, including risk assessment, governance, incident response and security testing.
• Sound technical knowledge of application, infrastructure and cloud security, enough to evaluate threat models, assessment reports and test results.
• Good knowledge of ISO/IEC 27001, NIST and CIS, and experience coordinating with customers, vendors and third-party security providers.
• Experience working to formal processes and specifications, such as tender security requirements and audit-ready evidence.
• Strong written, presentation and stakeholder management skills, with precise reports and minutes that stand up to scrutiny.
• Resilience and composure: stays professional and solution-focused with demanding or challenging stakeholders.
• Attention to detail and discipline: takes pride in following processes and specifications to the letter and producing accurate, traceable work.
• Ownership and drive: takes initiative, follows through to closure and is keen to grow into senior security leadership.
• A security certification, or working towards one (CISSP, CISM, CCSP, CISA or CRISC).
• Exposure to DevSecOps and AI-enabled solution security.
• Singapore Public Sector experience, including government ICT security policies.

Not for You If

This role is not a fit if:

• You prefer back-office compliance work rather than being customer-facing on live delivery.
• You want a purely hands-on testing role rather than coordinating and assessing the work of specialist partners.
• You see processes and specifications as flexible guidelines rather than commitments to follow to the letter.
• You're uncomfortable holding firm with demanding stakeholders or being the primary point of contact for security escalations.