Lead Software Engineer (Cybersecurity Specialist)

Responsibilities

Secure and Resilient Architecture (Core Mandate)

• Own the reference security architecture: trust boundaries, identity architecture, segmentation and trust-zone strategy, east-west controls, encryption and key management, and blast-radius containment.
• Embed secure-by-design controls by working inside product and engineering teams throughout the delivery lifecycle, at design, solutioning, and implementation stages rather than as post-build validation.
• Maintain a living threat model for systems and trust boundaries, referenced to MITRE ATT&CK and relevant adversary classes (including supply-chain threats), and use it to drive architecture and segmentation decisions rather than solely remediation prioritization.

Resilience and Business Continuity

• Engineer platform recoverability and graceful degradation, including degraded-mode operation, recovery objectives, and containment designs that preserve critical business operations during cyber incidents.
• Map and manage dependency and concentration risk across the ecosystem, including customers, partners, third-party providers, and supply-chain integrations.
• Design for and participate in cyber resilience exercises, incorporating lessons learned into the architecture.

Defensive Terrain

• Partner with security leadership as the technical design authority to define digital architecture and security boundaries using multi-layered defence, translating security and regulatory requirements into practical architecture decisions.
• Co-develop defensible architecture and resilience strategies to support stakeholder, audit, and regulatory engagements.

Platform Leverage and Control Inheritance

• Determine and document which security controls are inherited from enterprise platforms and shared services (e.g., cloud platforms, centralized monitoring, CI/CD guardrails, baseline security controls) versus those that application teams must build and maintain.
• Maintain shared responsibility models as architectural artefacts to clearly define ownership and audit boundaries.

Continuous Assurance and Secure Delivery

• Express security control intent as code through pipeline guardrails, policy-as-code, and continuous control monitoring so conformance can be observed continuously.
• Champion secure SDLC and agile security practices within engineering teams, enabling teams rather than creating delivery bottlenecks.

Transitional / Day-2 Scope (Explicitly Secondary)

The following are transitional and not the primary remit. Operational validation of architecture designs should be performed by an independent assurance function to preserve control independence. The role provides engineering guidance rather than self-validation:

• Advisory and incident response engineering support in coordination with security and operational stakeholders.
• Scoping and engineering guidance for external security assessments and penetration testing, with validation of remediation performed independently.

Requirements

• 10+ years in Cybersecurity as a Software Engineer and not just in the capacity of auditing, pen-testing, operational triage, etc.
• We need someone that is hands on where the ideal candidate is someone that can design systems to be secure and can sit down to write code if they need to, someone that can coach our engineering teams on how to write better and more secure code, and someone that understands the cybersecurity tooling landscape to help us choose the right tools, we are not looking for a high level theorist / academic.
• Demonstrated experience with designing security architecture into regulated / critical systems and platforms at the national or whole enterprise level, not just providing testing and assurance but actually designing and implementing.
• Working command of Singapore regulatory frameworks for critical systems: e.g. WOG IM8 (Reform), with the ability to translate obligation into architecture and to delineate control inheritance for audit scoping.
• Strong systems thinking: able to reason about a national platform as an interdependent whole — boundaries, failure modes, recoverability, and concentration risk — not as a checklist of controls.
• Depth across cloud and platform security architecture (IaaS/PaaS/SaaS), identity, encryption and key management, segmentation and zero-trust patterns, and secure SDLC / policy-as-code.
• Fluency with architectural and adversary frameworks (MITRE ATT&CK, NIST, ISO 27001, CIS benchmarks) used to drive design decisions.
• Ability to operate as a technical design authority alongside a CISO, clearly within the first line, and to produce architecture that withstands regulatory and audit scrutiny.
• Proficiency in at least one scripting/automation language (e.g. Python, TypeScript, Shell/Bash, et) for policy-as-code and tooling.
• Preferably proficient in both Kotlin/JVM stack and TypeScript.
• Architecture-leaning certifications are advantageous (e.g. CISSP / CISSP-ISSAP, SABSA, cloud security architecture). Incident-response and offensive certifications are useful but not the primary signal for this role.
• Subject to the nature of the role, onsite presence during fixed hours may be required.