IT Security Analyst, Governance, Risk and Compliance (Information Security Department) [NIE]

IT Security Analyst, Governance, Risk and Compliance (Information Security Department) [NIE]

Nanyang Technological University

Nanyang Technological University is one of the top universities in Singapore offering undergraduate and postgraduate education in engineering, business, science, humanities, arts, social sciences, education and medicine.

ABOUT THE NATIONAL INSTITUTE OF EDUCATION (NIE)

The National Institute of Education (NIE), Singapore, is Singapore’s national teacher education institute and we are proud to be an integral part of the nation’s education service. We play a key role in the preparation of teachers and in the provision of teacher professional and school leadership development programmes.

NIE invites suitable candidates to join the Division of Academic Computing & Information Services (ACIS) as a Security Analyst for Governance, Risk, and Compliance (GRC). This is a 3-year contract position.

Key Responsibilities:

1. Coordinate with internal and external audit teams and assist in audit planning.
2. Help deliver security awareness programs for staff and manage security governance efforts.
3. Stay updated on IT trends and recommend best practices to align with governance policies.
4. Support cybersecurity projects to ensure alignment with security objectives.
5. Assist in identifying and assessing IT risks and managing vulnerabilities and threats.
6. Support risk management in cybersecurity projects by focusing on threats and vulnerabilities.
7. Track and monitor audit remediation actions related to risk management.
8. Measure the effectiveness of security awareness programs to minimize risks from human error.

Compliance:

1. Ensure compliance with internal standards (ISO 27001, ISO 22301) and external regulations.
2. Facilitate responses to internal and external IT audits.
3. Participate in audit engagements and report on audit issues and remediation.
4. Provide ongoing compliance reporting to ensure timely remediation of audit findings.

Requirements:

Educational Qualification(s):

1. A University Degree in Information Technology, Cybersecurity, Risk Management, or Compliance, or an equivalent qualification.
2. Desirable Certifications: CISSP, CISM, CISA, CRISC, or other relevant certifications.
3. 3-5 years of experience in Information Security, IT Risk Management, or Compliance, preferably in a higher education or similar environment.
4. Experience with IT security audits and compliance reviews in regulated industries.
5. Experience with vendor security assessments and managing third-party security risks.
6. Experience in security awareness training and working in cross-functional teams.

Knowledge Required:

1. Security Frameworks: ISO 27001, CTM, NIST, CIS controls, and their application in operational environments.
2. Regulatory Standards: Understanding of the Cybersecurity Bill, PDPA, and related security laws.
3. Risk Management: Knowledge of risk assessments, mitigation strategies, and identifying threats to information systems.
4. Audit Processes: Understanding security audit processes, compliance, and remediation.
5. IT System: Good knowledge of IT infrastructure, application management, and cybersecurity practices.
6. GRC Tools: Experience with Governance, Risk, and Compliance platforms and software is advantageous.

Skills and Competencies:

1. Analytical Skills: Ability to analyze security risks and make data-driven decisions.
2. Communication Skills: Ability to convey technical security concepts to non-technical audiences and document findings.
3. Problem-Solving: Strong problem-solving capabilities, particularly during security incidents.
4. Attention to Detail: High focus on detail in audits and risk assessments.
5. Project Management: Ability to manage multiple projects, prioritize tasks, and meet deadlines.
6. Team Collaboration: Proven ability to work with cross-functional teams (IT, legal, compliance, vendors).

Other Personal Attributes:

1. Integrity and Confidentiality: High ethical standards and the ability to handle sensitive information.
2. Proactivity: Ability to act independently and proactively address security challenges.
3. Adaptability: Capable of adjusting to evolving security threats and changes in regulations.
4. Resilience under Pressure: Ability to make sound decisions under pressure, particularly during audits or security incidents.

Closing Date:
The closing date of the advertisement is 13 November 2024. We regret that only shortlisted candidates will be notified.