Manager, Cybersecurity Assurance & Resilience

Company description:

SMRT Trains Ltd was incorporated in 1987 and operates Singapore's first mass rapid transit system. Today, we manage and operate train services on the North-South Line, East-West Line, the Circle Line, the Thomson-East Coast Line, and the Bukit Panjang Light Rail Transit. With over 5,000 employees, more than 250 trains, and 141 km of rail tracks across 108 stations, we serve millions of commuters daily.

We have set our core values to be Integrity, Service & Safety and Excellence. SMRT is committed to provide safe, reliable and comfortable service for our commuters.

Job description:

Job Purpose

In today's rapidly evolving threat landscape, cybersecurity governance is essential to maintaining operational integrity and regulatory compliance. SMRT is seeking a detail-oriented and proactive Manager, Cybersecurity Assurance & Resilience to join our Governance, Risk and Compliance (GRC) team. This role is responsible for ensuring the effectiveness of SMRT's cybersecurity assurance, resilience and third-party risk management programmes through the assessment of cybersecurity controls, oversight of compliance requirements, management of third-party cyber risks, and validation of organisational readiness to respond to and recover from cybersecurity incidents.

Responsibilities

As Manager, Cybersecurity Assurance & Resilience, you will support Head, Governance, Risk & Compliance in ensuring the effectiveness of SMRT's cybersecurity assurance, resilience and third-party risk management programmes. Your responsibilities include:

• Cybersecurity Assurance
o Plan, manage and execute cybersecurity assurance activities to assess the effectiveness of cybersecurity controls across systems, processes and business functions.
o Conduct reviews against cybersecurity policies, standards, regulatory requirements and industry frameworks to identify control gaps and improvement opportunities.
o Assess the implementation and operating effectiveness of cybersecurity controls and recommend corrective actions where necessary.
o Track remediation efforts and monitor the closure of identified findings and weaknesses.
o Support cybersecurity maturity assessments and benchmarking exercises to evaluate organisational cybersecurity capabilities.
o Coordinate evidence collection, validation and reporting for cybersecurity assurance reviews and audits.

• Cybersecurity Compliance Support
o Support cybersecurity compliance activities to ensure adherence to internal policies, standards, regulatory requirements and organisational obligations.
o Assist in monitoring and reporting cybersecurity compliance posture across business units and systems.
o Conduct compliance gap assessments and support remediation planning activities.
o Support internal and external audit engagements, regulatory inspections and compliance assessments.

• Third-Party Cyber Risk Management & Security Rating Monitoring
o Manage and continuously enhance the Cybersecurity Third-Party Risk Management (TPRM) programme and associated assessment processes.
o Perform cybersecurity due diligence assessments for vendors, suppliers and service providers.
o Monitor vendor's cybersecurity posture and security ratings to identify emerging risks and ensure timely remediation of identified issues.
o Prepare assessment repots, risk findings and recommendations to support management decision-making, procurement evaluation and governance reviews.

• Cybersecurity Resilience & Table-Top Exercises
o Develop, coordinate and facilitate cybersecurity table-top exercises, cyber crisis simulations and incident response exercises.
o Design realistic cyberattack scenarios to validate incident response, crisis management and decision-making processes.
o Document exercise outcomes, lessons learnt and recommendations for improvement.
o Support initiatives to strengthen organisational cyber resilience, operational readiness recovery capabilities.

Qualifications & Work Experience

• A bachelor's degree in Cybersecurity, Information Systems, Computer Science, or a related discipline.
• 5-10 years of experience in cybersecurity governance, audit, assurance, compliance, resilience or third-party risk management.
• Familiarity with cybersecurity frameworks such as NIST CSF, ISO/IEC 27001, and CIS Controls will be advantageous.
• Experience managing vendor cybersecurity assessments and third-party risk management programmes will be advantageous.
• Experience designing or facilitating cyber incident response exercises and table-top exercises will be advantageous.
• Knowledge of regulatory requirements including the Cybersecurity Code of Practice (CCoP), Personal Data Protection Act (PDPA), and sector-specific standards will be advantageous.

Skills

Technical Skills
• Understanding of cybersecurity governance, assurance and compliance principles.
• Ability to assess control effectiveness and identify gaps in policy implementation.
• Skilled in evidence gathering and report writing.
• Familiarity with third-party risk management methodologies and vendor security assessment practices.
• Ability to develop meaningful cybersecurity metrics, reports and dashboards.

Core Competencies
• Excellent analytical and documentation skills, with strong attention to detail.
• Effective communicator with the ability to engage stakeholders across technical and non-technical domains.
• High integrity and discretion in handling sensitive information.
• Proactive and collaborative mindset, with a commitment to continuous improvement