Security Consultant (Contract)

• Location: MAS: MAS Building
• [What the role is]
• As a Security Consultant, you will drive and deliver a multi-year quantum-safe migration programme across MAS.
• Working with cross-functional stakeholders, you will define scope, manage schedules and dependencies, track risks and issues, and report progress to leadership.
• [What you will be working on]

Cybersecurity Project Management

• Lead and manage cybersecurity projects across the organisation, including tool implementation, process improvements, and compliance initiatives
• Collaborate with business units to ensure successful delivery and adoption whilst managing multiple workstreams, timelines, and dependencies
• Track project milestones, risks, budgets, and provide strategic reporting to enhance organisational security posture

Vendor & Contract Management

• Manage cybersecurity vendors including awareness platforms, incident response partners, and security solution providers
• Oversee contract renewals, performance reviews, SLAs, and procurement processes whilst ensuring compliance with internal and regulatory requirements
• Conduct comprehensive vendor evaluations, manage security clearance requirements, and coordinate procurement processes
• Governance, Programme and Agile Delivery
• Lead complex, multi-year technology delivery across MAS, aligned with business objectives and approved scope, budget, timelines and risk appetite.
• Act as programme secretariat and delivery lead for steering committees and workstreams, with clear terms of reference, decision rights, ownership, governance cadences and escalation paths.
• Maintain integrated delivery plans, Agile backlogs, decision records, financial and resource forecasts, action tracking and executive reporting.
• Apply fit-for-purpose Agile methods, tools, ceremonies and metrics to improve delivery flow, transparency, quality and continuous improvement while meeting MAS governance and assurance requirements.
• Facilitate architecture, risk, funding and delivery forums, presenting options, dependencies, impacts and recommendations to support timely decisions.
• Align business, technology, cybersecurity, procurement, legal, risk, audit and operations stakeholders around outcomes, user needs and acceptance criteria, removing barriers across teams.

Requirements, Service Design and Migration Planning

• Elicit, analyse, scope and manage business, technical, security and operational requirements, translating them into prioritised user stories, technical specifications and measurable acceptance criteria.
• Define the service vision, target operating model, delivery strategy and roadmap for quantum-safe capabilities using service-design and user-centred approaches where appropriate.
• Maintain an integrated dependency map covering business services, applications, infrastructure, data flows, cryptographic assets, certificates, keys, protocols, libraries, hardware, third parties and change windows.
• Maintain a risk-based quantum migration register considering data sensitivity and retention, “harvest now, decrypt later” and “trust now, forge later” exposure, business criticality, algorithm and key usage, vendor readiness and remediation complexity.
• Translate the cryptographic inventory into prioritised migration waves, release plans, resource forecasts, budgets and cutover schedules, tracking remediation from discovery through decommissioning.
• Plan for crypto-agility, interoperability, rollback, business continuity and approved coexistence or hybrid approaches, with accountable owners, evidence, exceptions and residual-risk acceptance.
• Procurement, Vendor and Supply-Chain Management
• Obtain, assess and periodically refresh supplier PQC roadmaps, supported algorithms, implementation timelines, product dependencies, upgrade paths and end-of-support dates.
• Coordinate proofs of concept and interoperability, performance, resilience and security testing before production adoption.
• Identify concentration, lock-in and supply-chain risks, maintaining contingency options where vendor readiness may affect critical milestones.
• Standards, Policy and Horizon Scanning
• Monitor authoritative quantum-safe guidance and standards, including relevant Singapore guidance, NIST PQC standards and transition guidance, and applicable IETF protocol specifications.
• Maintain a standards watchlist distinguishing final standards from drafts and recording applicability, maturity, implementation implications and required programme decisions.
• Translate regulatory, policy, standards and industry developments into architecture guardrails, information-security controls, procurement requirements, migration patterns, backlog changes and stakeholder briefings.
• Benchmark deployment practices and lessons from financial services and critical infrastructure without treating emerging or draft guidance as approved production standards.
• Ensure delivery aligns with MAS quality management systems, information-security policies, technology risk requirements and relevant industry standards.
• Technical Delivery, Assurance and Automation
• Coordinate cryptographic discovery, inventory validation and ownership attestation across on-premises, cloud, network, endpoint, application, data and operational technology environments.
• Define delivery gates and evidence-based acceptance criteria for solution design, threat modelling, interoperability, performance, resilience, security testing, privacy and operational readiness.
• Oversee pilots and migration waves, including environment readiness, change approvals, cutover, rollback, incident readiness, service transition, post-implementation review and benefits realisation.
• Integrate migration outputs with enterprise architecture, configuration and asset management, certificate and key management, vulnerability management, service management and audit evidence repositories.
• Use project-management tools and Agile metrics to report inventory coverage, ownership attestation, risk reduction, remediation completion, test pass rates, exceptions, vendor readiness, delivery velocity and milestone variance.
• Identify and drive responsible use of AI and automation for inventory analysis, evidence collection, reporting, workflow orchestration and control monitoring in accordance with MAS requirements.
• [What we are looking for]
• At least 8 years of experience in technology project or programme management, with a strong background in Agile delivery, digital services, cybersecurity, infrastructure or cryptographic transformation in large-scale organisations.
• Bachelor's degree in a relevant field (e.g., Information Technology, Computer Science, Business, Communications, or related disciplines)
• Cybersecurity certifications (e.g., CISSP, CISM, Security+, GCIH, or equivalent)
• Project management certifications (e.g., PMP, PRINCE2, Agile/Scrum certifications)
• Proven track record of delivering complex technology programmes and managing scope, budget, schedules, dependencies, risks, quality and benefits in regulated or high-availability environments.
• Working knowledge of public-key infrastructure, TLS, certificates, key management, hardware security modules, cryptographic libraries, cloud and network security, crypto-agility and PQC migration concepts.
• Strong analytical, business-analysis and process-improvement capabilities, with proficiency in project-management tools, Agile metrics and evidence-based reporting.
• Excellent communication and stakeholder-management skills, including the ability to explain technical concepts, risks and options to non-technical and senior audiences.
• Demonstrated ability to manage vendors and outsourced delivery, develop tender requirements, evaluate proposals and hold suppliers accountable for quality and outcomes.
• Experience in service design, user-centred delivery, quality management systems, information-security policies and relevant industry standards.
• Relevant experience using AI and automation to improve operational effectiveness, productivity or security outcomes, with the ability to identify and drive further opportunities.
• Ability to work independently and assume responsibility for programme deliverables
• Detail oriented team player.
• Experience in reporting and dashboarding tools (e.g., JIRA, Excel, Power BI, Tableau).
• Experience with Agile/Scrum methodologies.
• Automation skills (e.g., Python, VBA, Power Automate, scripting) for process improvement and efficiency.