IT Security Officer (ITSO)

IT SECURITY OFFICER

The Senior IT Security Officer is responsible for providing cybersecurity governance, risk management, security assurance and security advisory across ICT systems, digital services, cloud platforms and infrastructure

The role works closely with system owners, application teams, infrastructure and cloud teams, cybersecurity operations, enterprise architects, project managers, vendors and management to ensure that security risks are identified early, controls are proportionate and effective, and systems are operated in accordance with applicable Government ICT&SS policies and standards, organisational requirements, contractual obligations and recognised cybersecurity good practices.

Key Responsibilities

Cybersecurity Governance and Risk Management

· Provide independent cybersecurity governance and advisory across the project and system lifecycle.

· Lead or review cybersecurity risk assessments, including threat identification, vulnerability analysis, attack-path considerations, inherent risk, residual risk, compensating controls and risk treatment plans.

· Ensure material security risks, deviations and exceptions are properly documented, justified, tracked, escalated and formally accepted by the appropriate risk owner when required.

· Monitor recurring control gaps, overdue remediation and systemic risks, and recommend programme-level corrective actions.

· Maintain clear security decision records, evidence and audit trails for governance and management assurance.

Security Architecture and Security-by-Design

· Review application, cloud, infrastructure, network, identity and integration architectures for security risks and control gaps.

· Assess trust boundaries, data flows, privileged access paths, external exposure, administrative interfaces, API integrations and dependency risks.

· Challenge security assumptions and ensure proportionate preventive, detective and recovery controls are included before production implementation.

· Advise teams on secure design patterns for authentication, authorisation, encryption, secrets, logging, segmentation, resilience and least privilege.

· Participate in architecture review boards, design reviews, go-live readiness reviews and security acceptance decisions.

Cloud, Identity and Platform Security

· Assess cloud security designs and configurations across AWS, Microsoft Azure and/or Google Cloud, including IAM, network controls, workload protection, encryption, key management, logging and monitoring.

· Review identity and access management controls including MFA, privileged access, RBAC, service accounts, workload identities, conditional access and access lifecycle management.

· Assess Zero Trust, ZTNA, remote access, endpoint security and security service integrations where applicable.

· Evaluate security implications of SaaS, managed services, containers, Kubernetes and other modern platform technologies.

Vulnerability Management, VA/PT and Security Testing

· Review vulnerability findings and determine practical risk, remediation priority and required treatment based on business context and exploitability.

· Track remediation against applicable service levels and escalate overdue or repeated high-risk findings.

· Define or review security testing requirements, including vulnerability assessment, penetration testing, application security testing, configuration review and other assurance activities.

· Review test reports, validate remediation evidence and challenge inappropriate risk acceptance or weak compensating controls.

· Support secure development practices by reviewing relevant SAST, DAST, SCA, API security and CI/CD security evidence where applicable.

Security Operations and Incident Response

· Work with SOC and security operations teams to ensure appropriate logging, telemetry, alerting, detection use cases and escalation paths exist for critical systems.

· Participate in or coordinate cybersecurity incident response, investigation, containment, eradication, recovery and lessons-learned activities as required.

· Translate incident findings and adversary techniques into preventive improvements, detection requirements and remediation actions.

· Assess emerging vulnerabilities, CVEs and threat intelligence to determine applicability and priority for systems within the assigned portfolio.

· Support cyber exercises, tabletop exercises and operational readiness testing.

Cyber Resilience and Recovery

· Review cybersecurity aspects of business continuity, disaster recovery, backup, restoration and ransomware resilience arrangements.

· Assess recovery dependencies, privileged recovery paths, backup protection, immutability and recovery test evidence.

· Participate in disaster recovery and cyber resilience exercises and ensure security lessons are tracked to closure.

Stakeholder Management, Reporting and Leadership

· Act as a trusted cybersecurity advisor to project teams, system owners, business stakeholders and senior management.

· Explain complex cybersecurity risks in clear business language and recommend practical options for decision-making.

· Prepare concise management reports covering key risks, vulnerabilities, incidents, audit findings, remediation progress and security posture.

· Mentor junior ITSOs and contribute to consistent security assessment methods, templates, playbooks and standards across the organisation.

· Escalate material risks objectively and maintain independence when reviewing solutions or risk acceptance requests.

Minimum Requirements

· Minimum 7 years of relevant IT or cybersecurity experience, with substantial experience in cybersecurity governance, risk management, security assurance, architecture, operations, cloud security, audit or security consulting.

· At least 3 years of experience independently reviewing or governing enterprise-scale systems, major ICT projects or government/public-sector environments.

· Demonstrated ability to conduct or critically review cybersecurity risk assessments and recommend proportionate technical and governance controls.

· Strong understanding of enterprise security architecture across applications, infrastructure, networks, cloud, identity and security operations.

· Experience working with technical teams, project management, auditors, vendors and senior stakeholders.

· Strong written and verbal communication skills, including the ability to produce clear risk statements, security recommendations, management papers and audit responses.

· Ability to work independently, exercise professional judgement and escalate material risk where necessary.

· Relevant degree in Cybersecurity, Information Systems, Computer Science, Engineering or a related discipline; equivalent professional experience may be considered.

Professional Certifications

The candidate should possess at least one current recognised professional cybersecurity certification. Suitable certifications include:

· CISSP - Certified Information Systems Security Professional

· CISM - Certified Information Security Manager

· CRISC - Certified in Risk and Information Systems Control

· CISA - Certified Information Systems Auditor

· CCSP - Certified Cloud Security Professional

· CGEIT - Certified in the Governance of Enterprise IT

· Relevant GIAC certifications or equivalent professional cybersecurity certifications

Framework and Standards Knowledge

The Senior ITSO should have practical working knowledge of relevant frameworks and be able to apply them proportionately rather than as a checklist. Useful knowledge includes:

· Applicable Singapore Government ICT&SS cybersecurity policies, standards, control requirements and agency-specific security directives.

· ISO/IEC 27001 and ISO/IEC 27002.

· NIST Cybersecurity Framework and relevant NIST SP 800-series guidance.

· CIS Controls and CIS Benchmarks.

· MITRE ATT&CK for understanding adversary tactics and techniques.

· OWASP guidance for web application and API security.

· Cloud security good practices and shared-responsibility principles.

· Applicable legal, regulatory and data-protection requirements, including PDPA and sector-specific obligations where relevant.

À savoir avant de postuler

• Autorisation de travail: Cognizant ne prendra en considération que les candidats à ce poste qui sont légalement autorisés à travailler au Canada sans avoir besoin d'un parrainage de l'employeur, aujourd'hui ou à l'avenir.
• Mesures d’adaptation: Si vous avez un handicap qui nécessite des mesures d’adaptation raisonnable pour effectuer une recherche d’emploi ou poser une candidature, veuillez envoyer un courriel à [email protected] avec votre demande et vos coordonnées.
• L’IA dans notre processus de recrutement: Nous utilisons des outils d'intelligence artificielle (IA) pour trier et évaluer les candidatures efficacement. Notre équipe examine ensuite les candidatures et décide qui passe à l’étape suivante.
• Poste à pourvoir: Sauf indication contraire, ce poste est actuellement vacant et nous cherchons à le pourvoir.
• Exigences linguistiques: Nous demandons à tous les candidats de posséder une connaissance de base de l’anglais afin de faciliter les communications internes. Pour les postes au Québec, la capacité à communiquer efficacement en anglais est requise car vous fournirez des services à et collaborerez avec des parties prenantes anglophones situées hors de la province.
• Inclusion: Cognizant est un employeur souscrivant au principe de l’égalité d’accès à l’emploi. Votre candidature et votre dossier ne seront pas examinés en fonction de la race, de la couleur, du sexe, de la religion, des croyances, de l'orientation sexuelle, de l'identité de genre, de l'origine nationale, du handicap, des renseignements génétiques, de la grossesse, du statut d'ancien combattant ou de toute autre caractéristique protégée par les lois fédérales, provinciales ou locales.

À propos de Cognizant
Cognizant (NASDAQ: CTSH) est un AI Builder et une entreprise de services numériques (ESN) élaborant des solutions complètes d’IA maximisant les investissements pour des résultats concrets. Sa profonde expertise des métiers, des processus et des technologies lui permet d’intégrer dans les systèmes technologiques le contexte unique de chaque organisation de l’ingénierie à la production à l’échelle. Son objectif: améliorer l’efficacité des équipes, créer de la valeur et permettre aux grandes entreprises de rester performantes dans un monde qui évolue rapidement. Pour en savoir plus: cognizant.ai ou @cognizant.