Manager, Cybersecurity Assurance & Resilience

Job Purpose

In today’s rapidly evolving threat landscape, cybersecurity governance is essential to maintaining operational integrity and regulatory compliance. SMRT is seeking a detail-oriented and proactive Manager, Cybersecurity Assurance & Resilience to join our Governance, Risk and Compliance (GRC) team. This role is responsible for ensuring the effectiveness of SMRT’s cybersecurity assurance, resilience and third-party risk management programmes through the assessment of cybersecurity controls, oversight of compliance requirements, management of third-party cyber risks, and validation of organisational readiness to respond to and recover from cybersecurity incidents.

Responsibilities

As Manager, Cybersecurity Assurance & Resilience, you will support Head, Governance, Risk & Compliance in ensuring the effectiveness of SMRT’s cybersecurity assurance, resilience and third-party risk management programmes. Your responsibilities include:

• Cybersecurity Assurance
o Plan, manage and execute cybersecurity assurance activities to assess the effectiveness of cybersecurity controls across systems, processes and business functions.
o Conduct reviews against cybersecurity policies, standards, regulatory requirements and industry frameworks to identify control gaps and improvement opportunities.
o Assess the implementation and operating effectiveness of cybersecurity controls and recommend corrective actions where necessary.
o Track remediation efforts and monitor the closure of identified findings and weaknesses.
o Support cybersecurity maturity assessments and benchmarking exercises to evaluate organisational cybersecurity capabilities.
o Coordinate evidence collection, validation and reporting for cybersecurity assurance reviews and audits.

• Cybersecurity Compliance Support
o Support cybersecurity compliance activities to ensure adherence to internal policies, standards, regulatory requirements and organisational obligations.
o Assist in monitoring and reporting cybersecurity compliance posture across business units and systems.
o Conduct compliance gap assessments and support remediation planning activities.
o Support internal and external audit engagements, regulatory inspections and compliance assessments.

• Third-Party Cyber Risk Management & Security Rating Monitoring
o Manage and continuously enhance the Cybersecurity Third-Party Risk Management (TPRM) programme and associated assessment processes.
o Perform cybersecurity due diligence assessments for vendors, suppliers and service providers.
o Monitor vendor’s cybersecurity posture and security ratings to identify emerging risks and ensure timely remediation of identified issues.
o Prepare assessment repots, risk findings and recommendations to support management decision-making, procurement evaluation and governance reviews.

• Cybersecurity Resilience & Table-Top Exercises
o Develop, coordinate and facilitate cybersecurity table-top exercises, cyber crisis simulations and incident response exercises.
o Design realistic cyberattack scenarios to validate incident response, crisis management and decision-making processes.
o Document exercise outcomes, lessons learnt and recommendations for improvement.
o Support initiatives to strengthen organisational cyber resilience, operational readiness recovery capabilities.

Qualifications & Work Experience

• A bachelor’s degree in Cybersecurity, Information Systems, Computer Science, or a related discipline.
• 5–10 years of experience in cybersecurity governance, audit, assurance, compliance, resilience or third-party risk management.
• Familiarity with cybersecurity frameworks such as NIST CSF, ISO/IEC 27001, and CIS Controls will be advantageous.
• Experience managing vendor cybersecurity assessments and third-party risk management programmes will be advantageous.
• Experience designing or facilitating cyber incident response exercises and table-top exercises will be advantageous.
• Knowledge of regulatory requirements including the Cybersecurity Code of Practice (CCoP), Personal Data Protection Act (PDPA), and sector-specific standards will be advantageous.

Skills

Technical Skills
• Understanding of cybersecurity governance, assurance and compliance principles.
• Ability to assess control effectiveness and identify gaps in policy implementation.
• Skilled in evidence gathering and report writing.
• Familiarity with third-party risk management methodologies and vendor security assessment practices.
• Ability to develop meaningful cybersecurity metrics, reports and dashboards.

Core Competencies
• Excellent analytical and documentation skills, with strong attention to detail.
• Effective communicator with the ability to engage stakeholders across technical and non-technical domains.
• High integrity and discretion in handling sensitive information.
• Proactive and collaborative mindset, with a commitment to continuous improvement