Information Security Consultant

ROLE OVERVIEW The Information Security Consultant is one of the most pivotal roles at Insyghts Security. This is a broad, high-impact position designed for a rare professional who can operate credibly across the full breadth of our advisory and consulting service portfolio — from hands-on offensive security assessments and CSA certification readiness, to delivering virtual CISO leadership and outsourced Data Protection Officer services for clients. This role demands an exceptional combination of deep technical knowledge, regulatory fluency across both Malaysia and Singapore, and the executive communication skills to engage confidently at every level — from technical teams through to board members and regulators. Our consultants are not report writers; they are trusted partners who sit alongside clients, challenge their assumptions, and help them build security programmes that are genuinely resilient. The ideal candidate brings proven experience across GRC, compliance consulting, offensive security, and privacy law — and is intellectually excited by the opportunity to serve clients across all of these disciplines within a single, varied role. You will be one of the primary faces of Insyghts Security in the market, and your quality of work directly shapes our reputation. SERVICE LINES & KEYRESPONSIBILITIES This role spans five distinct consulting service lines. Candidates are expected to be competent across all five and capable of leading client engagements independently. The depth of expertise required in each area is described below. A | GRC, Risk Advisory & Compliance Core advisory services covering governance, risk management, compliance frameworks, ISO 27001implementation, and business continuity planning. • Lead information security risk assessments, gap analyses, and maturity evaluations aligned to ISO 27001, NIST CSF, CIS Controls v8, and sector-specific frameworks • Develop and refine information security policies, procedures, governance frameworks, and ISMS documentation for clients • Advise clients on regulatory compliance obligations including ISO 27001, PCI DSS v4.0,MAS TRM, BNM RMiT, HIPAA, and GDPR • Lead end-to-end ISO 27001 implementation projects — from initial gap assessment and scope definition through to certification readiness and audit support • Conduct Business Continuity (BCP) and Disaster Recovery (DRP) planning, business impact analysis, and tabletop exercise facilitation • Perform third-party and supply chain risk assessments; assist clients in building and maintaining vendor risk management programmes • Design and facilitate security awareness training and culture-building programmes tailored to client organisations • Prepare and present executive-quality reports, board-level presentations, and regulatory submissions B | CSA Cyber Essentials & Cyber Trust Mark Specialist advisory services helping clients achieve CSA Cyber Essentials (CE) and Cyber Trust Mark (CTM) certification under Singapore's national cybersecurity scheme, including the expanded 2025 framework covering Cloud, OT, and AI security. • Guide clients through the CSA Cyber Essentials (2025) certification process — from self-assessment and gap analysis through to certification body audit readiness • Advise on all domains of the expanded Cyber Essentials framework including classical cybersecurity, cloud security, OT security, and AI security controls • Lead clients through CSA Cyber Trust Mark engagements — conducting risk profiling, determining the appropriate Cybersecurity Preparedness Tier, and building the corresponding security programme • Develop and document the cybersecurity controls, evidence artefacts, and risk treatment plans required to satisfy Cyber Essentials and Cyber Trust Mark certification requirements • Deliver Cybersecurity Health Plan engagements as part of CSA's CISOaaS scheme, assisting eligible SMEs in strengthening their cyber resilience with funded consultancy support • Advise clients on the strategic benefits of CSA certification for tender eligibility, regulatory compliance, cyber insurance, and stakeholder trust in both Singapore and regional markets • Maintain current knowledge of CSA certification updates, funding schemes (e.g., Enterprise Development Grant, SME co-funding), and scheme evolutions to provide accurate, timely guidance C | Offensive Security & Penetration Testing Hands-on offensive security engagements including network, web application, social engineering, and red team assessment…