Cybersecurity Governance, Risk & Compliance (GRC) Analyst

Department: CISO Office
Location: Singapore
Experience: 6+ years preferred

Role Overview

We are seeking a Cybersecurity GRC Analyst to strengthen our cybersecurity governance, risk management and regulatory compliance capabilities. Operating as the Second Line of Defence, the role provides independent oversight and assurance of cybersecurity risks, regulatory compliance and security controls across our telecommunications infrastructure and corporate systems.

The successful candidate will work closely with cybersecurity, engineering and business teams to assess risks, challenge control effectiveness, monitor regulatory compliance and drive continuous security improvements.

Key Responsibilities

1. Cyber Risk Management: Maintain the cybersecurity risk register, independently review and challenge risk assessments, monitor risk treatment plans and coordinate risk acceptance and approval workflows.
2. Risk Reporting: Monitor cybersecurity risk indicators and prepare risk reports, dashboards and recommendations for senior management, risk committees and the Board.
3. Regulatory Compliance: Oversee compliance with applicable IMDA Telecommunications Cybersecurity Code (TCS) requirements, CSA Cybersecurity Code of Practice (CCoP) and other relevant regulations, including regulatory obligation mapping, compliance assessments and gap tracking.
4. Security Governance: Develop, review and maintain cybersecurity policies, standards and procedures, including the management of policy exceptions and deviations.
5. Security Assurance: Perform second-line assurance reviews, control assessments and compliance gap analyses against regulatory requirements and industry standards. Evaluate control effectiveness and recommend risk-based improvements.
6. Audit Management: Coordinate internal and external cybersecurity audits and regulatory assessments. Facilitate evidence collection, maintain audit findings registers and monitor remediation through closure.
7. Stakeholder Engagement: Provide independent risk and compliance advisory to technical and business teams, challenge control weaknesses and promote accountability for cybersecurity risk management.

Required Skills & Experience

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, Information Systems or a related discipline.
• 6-10 years of experience in cybersecurity governance, risk management, compliance, security assurance or IT audit.
• Experience conducting cybersecurity risk assessments, managing risk registers, reviewing risk treatment plans and coordinating risk acceptance processes.
• Knowledge of cybersecurity governance frameworks and standards, including ISO/IEC 27001 and NIST Cybersecurity Framework.
• Experience in security policy development, compliance assessments, control assurance and cybersecurity audits.
• Good understanding of cybersecurity controls across enterprise IT, network infrastructure, applications and cloud environments.
• Knowledge of telecommunications technologies, including 4G/5G mobile networks, radio access networks (RAN), mobile core systems and associated cybersecurity risks, would be advantageous.
• Familiarity with Singapore cybersecurity regulations, particularly IMDA TCS and CSA CCoP, is advantageous.
• Strong analytical, documentation, risk reporting and stakeholder management skills.
• Relevant certifications such as CISA, CRISC, CISM, CISSP or ISO/IEC 27001 Lead Auditor are advantageous.

Ideal Candidate

A proactive, hands-on cybersecurity GRC professional with strong analytical skills, sound risk judgement and the ability to provide independent oversight and challenge. Comfortable engaging technical teams and management, translating regulatory requirements into practical risk-based recommendations, and driving continuous improvement in cybersecurity governance and assurance.