Information Security Engineer (VA/PT)

Role: Information Security (Vulnerability Management and Penetration Testing)

Responsibilities

The role's responsibilities span three core areas: program management and governance across the combined function, day-to-day vulnerability management, and end-to-end penetration testing.

Program Management & Governance

• Build, run, and continuously improve the internal Vulnerability Management and Penetration Testing (VMPT) program and capabilities within the organization.

• Develop and refine the policies, processes, standards, and procedures for vulnerability management, penetration testing, communication, and reporting.

• Lead the triage of vulnerabilities and penetration test findings, taking into consideration compensating controls, threat exposure, and "True Risk" to Singlife, and prioritize remediation accordingly.

• Chair the vulnerability and penetration testing governance forum, driving accountability, tracking remediation SLAs, and escalating overdue or high-risk items to management.

• Manage the internal VMPT program and relationships with external VMPT/PT vendors and other stakeholders across Singlife.

• Establish and report meaningful metrics and dashboards on vulnerability and penetration testing posture, remediation progress, and program effectiveness to management and relevant committees.

• Identify gaps in adjacent processes and procedures and drive improvements from a risk-based vulnerability management (RBVM) and penetration testing perspective.

• Research, develop, and recommend appropriate tooling required for effective risk-based vulnerability management and penetration testing.

• Produce high-quality oral and written work products, presenting complex technical matters and findings clearly and concisely.

• Collaborate with supervisors and other cybersecurity team members on vulnerability management and penetration testing status and findings.

• Mentor and guide the technical development of junior VMPT staff and colleagues.

• Collaborate with stakeholders across the organization on security initiatives.

• Ensure compliance with all applicable laws and regulations relating to the above functional activities.

• Operate and maintain compliance with security baseline governance using appropriate tooling.

Vulnerability Management

• Own and manage the end-to-end vulnerability management process, from discovery and triage through remediation tracking, verification, and closure.

• Identify gaps in RBVM processes and procedures and drive continuous improvement.

• Build and lead the security review and monitoring of production environments across the hybrid infrastructure.

Penetration Testing

• Own and manage the end-to-end penetration testing program, from scoping and rules of engagement through execution oversight, findings management, retesting, and closure with external PT vendors and internal stakeholders.

• Define and maintain the annual, risk-based penetration testing plan, covering test types such as external and internal network, web and mobile application, API, cloud, wireless, social engineering, and red/purple team exercises.

• Set and enforce penetration testing standards, methodologies, and rules of engagement (e.g., OWASP, PTES, NIST SP 800-115, MITRE ATT&CK), and assure the quality, coverage, and independence of internal and vendor-delivered testing.

• Validate and retest remediated penetration test findings to confirm effective closure, and track exceptions and residual risk to acceptance or resolution.

• Ensure penetration testing satisfies regulatory and industry requirements (e.g., MAS TRM), and coordinate independent, threat-led and scenario-based testing where required.

Requirements

• Minimum 7 years of relevant security experience.

• Extensive experience in information security and/or IT risk management.

• Proven experience owning and running a vulnerability management and/or penetration testing program, process, and governance forum.

• Demonstrated leadership, project, and team-building skills, including the ability to lead teams and drive projects and initiatives across multiple departments.

• Ability to identify risks associated with business processes, operations, information security programs, and technology projects.

• Ability to communicate with diverse audiences, both technical and non-technical, to build consensus on risk-based vulnerability management and penetration testing.

• Experience with process optimization.

• Experience with process automation and workflow using ITSM tools.

• Hands-on experience with vulnerability management, penetration testing, and security engineering.

• Experience with industry-known vulnerability management, penetration testing, and CSPM solutions.

Vulnerability Management

• Strong knowledge of risk-based vulnerability management, including triage of vulnerabilities to determine "True Risk" exposure to Singlife.

• Experience in log configuration, formats, and feeding logs into SIEM platforms.

Penetration Testing

• Strong hands-on penetration testing background across multiple domains (network, web, mobile, API, and cloud), including managing external PT vendors and triaging and validating penetration test findings.

• Working knowledge of recognized penetration testing methodologies and frameworks (OWASP Testing Guide, PTES, NIST SP 800-115, MITRE ATT&CK) and common offensive tooling (e.g., Burp Suite, Nmap, Metasploit, Kali Linux, Cobalt Strike).

• Working knowledge of one or more programming/scripting languages such as Python, C++, Java, Ruby, Node, Go, and/or PowerShell.

Education

• Academic: Bachelor's degree in Computer Science or Information Technology (preferred).

• Professional Certification(s): One or more of CISSP, CISM, CISA, or SANS/GIAC certifications, together with a recognized penetration testing certification such as OSCP, GPEN, GWAPT, CREST (CRT/CCT), or CEH (preferred, or willing to become certified within one year).

If you are keen to explore the above role, please send across your updated resume to View email address on mycareersfuture.gov.sg and we can discuss to proceed further.

EA Personnel Registration Number: R1112410

Singapore Employment Agency Licence No: 11C3373