Manager, Cybersecurity Assurance & Resilience

Job Purpose

In today’s rapidly evolving threat landscape, cybersecurity governance is essential to maintaining operational integrity and regulatory compliance. SMRT is seeking a detail-oriented and proactive Manager, Cybersecurity Assurance & Resilience to join our Governance, Risk and Compliance (GRC) team. This role is responsible for ensuring the effectiveness of SMRT’s cybersecurity assurance, resilience and third-party risk management programmes through the assessment of cybersecurity controls, oversight of compliance requirements, management of third-party cyber risks, and validation of organisational readiness to respond to and recover from cybersecurity incidents.

Responsibilities

As Manager, Cybersecurity Assurance & Resilience, you will support Head, Governance, Risk & Compliance in ensuring the effectiveness of SMRT’s cybersecurity assurance, resilience and third-party risk management programmes. Your responsibilities include:

• Cybersecurity Assurance

o Plan, manage and execute cybersecurity assurance activities to assess the effectiveness of cybersecurity controls across systems, processes and business functions. o Conduct reviews against cybersecurity policies, standards, regulatory requirements and industry frameworks to identify control gaps and improvement opportunities. o Assess the implementation and operating effectiveness of cybersecurity controls and recommend corrective actions where necessary. o Track remediation efforts and monitor the closure of identified findings and weaknesses. o Support cybersecurity maturity assessments and benchmarking exercises to evaluate organisational cybersecurity capabilities. o Coordinate evidence collection, validation and reporting for cybersecurity assurance reviews and audits.

• Cybersecurity Compliance Support

o Support cybersecurity compliance activities to ensure adherence to internal policies, standards, regulatory requirements and organisational obligations. o Assist in monitoring and reporting cybersecurity compliance posture across business units and systems. o Conduct compliance gap assessments and support remediation planning activities. o Support internal and external audit engagements, regulatory inspections and compliance assessments.

• Third-Party Cyber Risk Management & Security Rating Monitoring

o Manage and continuously enhance the Cybersecurity Third-Party Risk Management (TPRM) programme and associated assessment processes. o Perform cybersecurity due diligence assessments for vendors, suppliers and service providers. o Monitor vendor’s cybersecurity posture and security ratings to identify emerging risks and ensure timely remediation of identified issues. o Prepare assessment repots, risk findings and recommendations to support management decision-making, procurement evaluation and governance reviews.

• Cybersecurity Resilience & Table-Top Exercises

o Develop, coordinate and facilitate cybersecurity table-top exercises, cyber crisis simulations and incident response exercises. o Design realistic cyberattack scenarios to validate incident response, crisis management and decision-making processes. o Document exercise outcomes, lessons learnt and recommendations for improvement. o Support initiatives to strengthen organisational cyber resilience, operational readiness recovery capabilities.

Qualifications & Work Experience

• A bachelor’s degree in Cybersecurity, Information Systems, Computer Science, or a related discipline.
• 5–10 years of experience in cybersecurity governance, audit, assurance, compliance, resilience or third-party risk management.
• Familiarity with cybersecurity frameworks such as NIST CSF, ISO/IEC 27001, and CIS Controls will be advantageous.
• Experience managing vendor cybersecurity assessments and third-party risk management programmes will be advantageous.
• Experience designing or facilitating cyber incident response exercises and table-top exercises will be advantageous.
• Knowledge of regulatory requirements including the Cybersecurity Code of Practice (CCoP), Personal Data Protection Act (PDPA), and sector-specific standards will be advantageous.

Skills

Technical Skills

• Understanding of cybersecurity governance, assurance and compliance principles.
• Ability to assess control effectiveness and identify gaps in policy implementation.
• Skilled in evidence gathering and report writing.
• Familiarity with third-party risk management methodologies and vendor security assessment practices.
• Ability to develop meaningful cybersecurity metrics, reports and dashboards.

Core Competencies

• Excellent analytical and documentation skills, with strong attention to detail.
• Effective communicator with the ability to engage stakeholders across technical and non-technical domains.
• High integrity and discretion in handling sensitive information.
• Proactive and collaborative mindset, with a commitment to continuous improvement