Manager, Cyber Assurance

The Cyber Assurance Manager is to provide cyber assurance through security assessments to ensure that Income's systems are not vulnerable and that potential weaknesses and exposures are mitigated or remediated timely in commensurate with our risk appetite. Reporting to the Head of Information Technology Risk & Security (ITRS) department, he/she will have the following responsibilities:

Manage a vulnerability management program to include ongoing vulnerability and configuration scanning, penetration testing and vulnerability disclosure and software security assessment

Manage a cyber threat intelligence program to collect and analyse information about relevant cyber threats, threat actors, vulnerabilities, and attack methods

Manage an offensive program to include ongoing breach and attack simulation, cyber range, red teaming and incident response exercise

Manage the risk assessment and risk treatment of discovered vulnerabilities by assessing the impact of the weakness, the effectiveness of the controls and the resultant risk exposure

Function as a Security Architect to advise on security requirements, and assess and ensure conformance to security architecture

Keep abreast of new technologies and related risks, industry trends, and regulatory requirements relating to technology, information & cyber security, and advise on the required controls and enhancements to protect our infrastructure and applications

Requirements

• Degree holder in Computer Science, Information Technology, Information Systems or equivalent
• More than 7 years of experience in technology, information or cyber risk management, or information security in Financial Services Industry
• Possess security certifications such as CISSP, CCSP, CISM, OSCP or TOGAF
• Experience in leading threat exposure management or security architecture review activities
• Experience with Continuous Threat Exposure Management and engineering of data and system integration for automated prioritisation
• Familiar with cloud technologies and services, and the required cloud security and risk management framework and controls
• Familiar with regulatory requirements as MAS Technology Risk Management and MAS Cyber Hygiene, statutory requirements as CSA and PDPA, and security standards as CIS, NIST, OWASP and TOGAF
• Familiar with leading Exposure Management Platforms as Tenable, Qualys or Rapid7