IT Security Lead (Amk)

Job Summary The IT Security Lead manages end-to-end security governance, compliance, and operations for mission-critical systems, collaborating with cross-functional teams and external auditors to ensure adherence to government security policies. Responsibilities Day 1 – Project / Implementation Security Define and implement system security architecture aligned with Singapore Government policies Review application, middleware, infrastructure, and platform designs for security compliance Conduct threat modeling and risk assessments, mapping risks to mitigating controls Translate policy requirements into actionable technical controls across technology stacks Ensure compliance with IM8, Whole-of-Government security requirements, and PDPA where applicable Establish and oversee cybersecurity governance across infrastructure, application, and project teams Prepare and maintain documentation including Security Risk Assessments, Vulnerability Assessments, Penetration Testing reports, and security hardening baselines Partner with software teams to enforce secure coding standards and DevSecOps practices Integrate and govern SAST/DAST, dependency/SCA scanning, and container image scanning within CI/CD pipelines Review and triage security tool findings, driving remediation and risk acceptance decisions Provide guidance on API security, token/secret management, and secure service-to-service communication Plan, coordinate, and manage vulnerability and penetration testing engagements and vendors Track remediation progress to closure and document residual risks and risk acceptance Support security clearances and go-live certifications Review and approve OS, middleware, database, Kubernetes/container security, API gateway, WAF, rate-limiting, and authentication configurations Day 2 – Operations / Production Security Lead security incident investigations, containment, and recovery efforts Perform root cause analysis and define corrective and preventive actions Coordinate with Government SOC and stakeholders; contribute to and refine incident response playbooks Communicate security incidents clearly to technical and non-technical audiences Oversee continuous vulnerability monitoring and posture management Track patch and configuration compliance across infrastructure, middleware, applications, and containers Provide risk assessments and compensating controls for deferred patches Review and tune alerts, detections, and dashboards in SIEM and related tools Ensure monitoring coverage for critical systems and high-value assets Support internal and external audits, evidence collection, and closure of audit findings Prepare and present security posture, metrics, and trend reports to management Maintain risk registers and mitigation plans with up-to-date security documentation Communicate security assessments and findings effectively to varied stakeholders Oversee and periodically review RBAC, MFA, Privileged Access Management, and joiner/mover/leaver processes Ensure least privilege access, segregation of duties, and periodic access recertifications Support incident response handling, log analysis, and activity reviews Drive continuous improvement across identify, protect, detect, respond, and recover functions Required competencies and certifications Degree in Computer Science, Cybersecurity, Information Security, or equivalent 8–12 years of IT experience including at least 5 years as a Security Lead or Security Architect Proven experience in Singapore Government IT projects and IM8/government security compliance Hands-on experience with Kubernetes/Docker security, API security, Identity & Access Management (IAM), and security tools (SAST/DAST/SIEM) integrated with CI/CD Preferred competencies and qualifications Certifications such as CISSP, CISM, CISA, CEH, GIAC (e.g., GSEC, GCIA, GCIH, GCSA) AWS or Azure Security certifications 5 day week @ AMK area Maestro HR damien lee tian hong R1106726 16C8462