Security Consultant (Contract)

Government of Singapore · MAS: MAS Building

[What the role is]

As a Security Consultant, you will drive and deliver a multi-year quantum-safe migration programme across MAS.

Working with cross-functional stakeholders, you will define scope, manage schedules and dependencies, track risks and issues, and report progress to leadership.

[What you will be working on]

Cybersecurity Project Management

Lead and manage cybersecurity projects across the organisation, including tool implementation, process improvements, and compliance initiatives
Collaborate with business units to ensure successful delivery and adoption whilst managing multiple workstreams, timelines, and dependencies
Track project milestones, risks, budgets, and provide strategic reporting to enhance organisational security posture

Vendor & Contract Management

Manage cybersecurity vendors including awareness platforms, incident response partners, and security solution providers
Oversee contract renewals, performance reviews, SLAs, and procurement processes whilst ensuring compliance with internal and regulatory requirements
Conduct comprehensive vendor evaluations, manage security clearance requirements, and coordinate procurement processes

Governance, Programme and Agile Delivery

Lead complex, multi-year technology delivery across MAS, aligned with business objectives and approved scope, budget, timelines and risk appetite.
Act as programme secretariat and delivery lead for steering committees and workstreams, with clear terms of reference, decision rights, ownership, governance cadences and escalation paths.
Maintain integrated delivery plans, Agile backlogs, decision records, financial and resource forecasts, action tracking and executive reporting.
Apply fit-for-purpose Agile methods, tools, ceremonies and metrics to improve delivery flow, transparency, quality and continuous improvement while meeting MAS governance and assurance requirements.
Facilitate architecture, risk, funding and delivery forums, presenting options, dependencies, impacts and recommendations to support timely decisions.
Align business, technology, cybersecurity, procurement, legal, risk, audit and operations stakeholders around outcomes, user needs and acceptance criteria, removing barriers across teams.

Requirements, Service Design and Migration Planning

Elicit, analyse, scope and manage business, technical, security and operational requirements, translating them into prioritised user stories, technical specifications and measurable acceptance criteria.
Define the service vision, target operating model, delivery strategy and roadmap for quantum-safe capabilities using service-design and user-centred approaches where appropriate.
Maintain an integrated dependency map covering business services, applications, infrastructure, data flows, cryptographic assets, certificates, keys, protocols, libraries, hardware, third parties and change windows.
Maintain a risk-based quantum migration register considering data sensitivity and retention, “harvest now, decrypt later” and “trust now, forge later” exposure, business criticality, algorithm and key usage, vendor readiness and remediation complexity.
Translate the cryptographic inventory into prioritised migration waves, release plans, resource forecasts, budgets and cutover schedules, tracking remediation from discovery through decommissioning.
Plan for crypto-agility, interoperability, rollback, business continuity and approved coexistence or hybrid approaches, with accountable owners, evidence, exceptions and residual-risk acceptance.

Procurement, Vendor and Supply-Chain Management

Obtain, assess and periodically refresh supplier PQC roadmaps, supported algorithms, implementation timelines, product dependencies, upgrade paths and end-of-support dates.
Coordinate proofs of concept and interoperability, performance, resilience and security testing before production adoption.
Identify concentration, lock-in and supply-chain risks, maintaining contingency options where vendor readiness may affect critical milestones.

Standards, Policy and Horizon Scanning

Monitor authoritative quantum-safe guidance and standards, including relevant Singapore guidance, NIST PQC standards and transition guidance, and applicable IETF protocol specifications.
Maintain a standards watchlist distinguishing final standards from drafts and recording applicability, maturity, implementation implications and required programme decisions.
Translate regulatory, policy, standards and industry developments into architecture guardrails, information-security controls, procurement requirements, migration patterns, backlog changes and stakeholder briefings.
Benchmark deployment practices and lessons from financial services and critical infrastructure without treating emerging or draft guidance as approved production standards.
Ensure delivery aligns with MAS quality management systems, information-security policies, technology risk requirements and relevant industry standards.

Technical Delivery, Assurance and Automation

Coordinate cryptographic discovery, inventory validation and ownership attestation across on-premises, cloud, network, endpoint, application, data and operational technology environments.
Define delivery gates and evidence-based acceptance criteria for solution design, threat modelling, interoperability, performance, resilience, security testing, privacy and operational readiness.
Oversee pilots and migration waves, including environment readiness, change approvals, cutover, rollback, incident readiness, service transition, post-implementation review and benefits realisation.
Integrate migration outputs with enterprise architecture, configuration and asset management, certificate and key management, vulnerability management, service management and audit evidence repositories.
Use project-management tools and Agile metrics to report inventory coverage, ownership attestation, risk reduction, remediation completion, test pass rates, exceptions, vendor readiness, delivery velocity and milestone variance.
Identify and drive responsible use of AI and automation for inventory analysis, evidence collection, reporting, workflow orchestration and control monitoring in accordance with MAS requirements.

[What we are looking for]

At least 8 years of experience in technology project or programme management, with a strong background in Agile delivery, digital services, cybersecurity, infrastructure or cryptographic transformation in large-scale organisations.
Bachelor's degree in a relevant field (e.g., Information Technology, Computer Science, Business, Communications, or related disciplines)
Cybersecurity certifications (e.g., CISSP, CISM, Security+, GCIH, or equivalent)
Project management certifications (e.g., PMP, PRINCE2, Agile/Scrum certifications)
Proven track record of delivering complex technology programmes and managing scope, budget, schedules, dependencies, risks, quality and benefits in regulated or high-availability environments.
Working knowledge of public-key infrastructure, TLS, certificates, key management, hardware security modules, cryptographic libraries, cloud and network security, crypto-agility and PQC migration concepts.
Strong analytical, business-analysis and process-improvement capabilities, with proficiency in project-management tools, Agile metrics and evidence-based reporting.
Excellent communication and stakeholder-management skills, including the ability to explain technical concepts, risks and options to non-technical and senior audiences.
Demonstrated ability to manage vendors and outsourced delivery, develop tender requirements, evaluate proposals and hold suppliers accountable for quality and outcomes.
Experience in service design, user-centred delivery, quality management systems, information-security policies and relevant industry standards.
Relevant experience using AI and automation to improve operational effectiveness, productivity or security outcomes, with the ability to identify and drive further opportunities.
Ability to work independently and assume responsibility for programme deliverables
Detail oriented team player.
Experience in reporting and dashboarding tools (e.g., JIRA, Excel, Power BI, Tableau).
Experience with Agile/Scrum methodologies.
Automation skills (e.g., Python, VBA, Power Automate, scripting) for process improvement and efficiency.

As part of the shortlisting process for this role, you may be required to complete a medical declaration and/or undergo further assessment.

This is 2-year contract position. All applicants will be notified on whether they are shortlisted or not within 4 weeks of the closing date of this job posting.

More jobs at Government of Singapore · Other jobs in Mas Mas