Manager, Cybersecurity Assurance & Resilience

Job Purpose

In today’s rapidly evolving threat landscape, cybersecurity governance is essential to maintaining operational integrity and regulatory compliance. SMRT is seeking a detail-oriented and proactive Manager, Cybersecurity Assurance & Resilience to join our Governance, Risk and Compliance (GRC) team. This role is responsible for ensuring the effectiveness of SMRT’s cybersecurity assurance, resilience and third-party risk management programmes through the assessment of cybersecurity controls, oversight of compliance requirements, management of third-party cyber risks, and validation of organisational readiness to respond to and recover from cybersecurity incidents. 

Responsibilities

As Manager, Cybersecurity Assurance & Resilience, you will support Head, Governance, Risk & Compliance in ensuring the effectiveness of SMRT’s cybersecurity assurance, resilience and third-party risk management programmes. Your responsibilities include:

•    Cybersecurity Assurance
o    Plan, manage and execute cybersecurity assurance activities to assess the effectiveness of cybersecurity controls across systems, processes and business functions. 
o    Conduct reviews against cybersecurity policies, standards, regulatory requirements and industry frameworks to identify control gaps and improvement opportunities. 
o    Assess the implementation and operating effectiveness of cybersecurity controls and recommend corrective actions where necessary. 
o    Track remediation efforts and monitor the closure of identified findings and weaknesses. 
o    Support cybersecurity maturity assessments and benchmarking exercises to evaluate organisational cybersecurity capabilities. 
o    Coordinate evidence collection, validation and reporting for cybersecurity assurance reviews and audits. 

•    Cybersecurity Compliance Support
o    Support cybersecurity compliance activities to ensure adherence to internal policies, standards, regulatory requirements and organisational obligations. 
o    Assist in monitoring and reporting cybersecurity compliance posture across business units and systems. 
o    Conduct compliance gap assessments and support remediation planning activities.
o    Support internal and external audit engagements, regulatory inspections and compliance assessments. 

•    Third-Party Cyber Risk Management & Security Rating Monitoring
o    Manage and continuously enhance the Cybersecurity Third-Party Risk Management (TPRM) programme and associated assessment processes. 
o    Perform cybersecurity due diligence assessments for vendors, suppliers and service providers. 
o    Monitor vendor’s cybersecurity posture and security ratings to identify emerging risks and ensure timely remediation of identified issues. 
o    Prepare assessment repots, risk findings and recommendations to support management decision-making, procurement evaluation and governance reviews.

•    Cybersecurity Resilience & Table-Top Exercises
o    Develop, coordinate and facilitate cybersecurity table-top exercises, cyber crisis simulations and incident response exercises. 
o    Design realistic cyberattack scenarios to validate incident response, crisis management and decision-making processes. 
o    Document exercise outcomes, lessons learnt and recommendations for improvement. 
o    Support initiatives to strengthen organisational cyber resilience, operational readiness recovery capabilities. 

Qualifications & Work Experience

•    A bachelor’s degree in Cybersecurity, Information Systems, Computer Science, or a related discipline.
•    5–10 years of experience in cybersecurity governance, audit, assurance, compliance, resilience or third-party risk management.
•    Familiarity with cybersecurity frameworks such as NIST CSF, ISO/IEC 27001, and CIS Controls will be advantageous.
•    Experience managing vendor cybersecurity assessments and third-party risk management programmes will be advantageous.
•    Experience designing or facilitating cyber incident response exercises and table-top exercises will be advantageous.
•    Knowledge of regulatory requirements including the Cybersecurity Code of Practice (CCoP), Personal Data Protection Act (PDPA), and sector-specific standards will be advantageous.

Skills

Technical Skills
•    Understanding of cybersecurity governance, assurance and compliance principles.
•    Ability to assess control effectiveness and identify gaps in policy implementation.
•    Skilled in evidence gathering and report writing.
•    Familiarity with third-party risk management methodologies and vendor security assessment practices.
•    Ability to develop meaningful cybersecurity metrics, reports and dashboards. 

Core Competencies
•    Excellent analytical and documentation skills, with strong attention to detail.
•    Effective communicator with the ability to engage stakeholders across technical and non-technical domains.
•    High integrity and discretion in handling sensitive information.
•    Proactive and collaborative mindset, with a commitment to continuous improvement