Security Consultant (Contract)

[What the role is]
As a Security Consultant, you will drive and deliver a multi-year quantum-safe migration programme across MAS.

Working with cross-functional stakeholders, you will define scope, manage schedules and dependencies, track risks and issues, and report progress to leadership.
[What you will be working on]
Cybersecurity Project Management

- Lead and manage cybersecurity projects across the organisation, including tool implementation, process improvements, and compliance initiatives

- Collaborate with business units to ensure successful delivery and adoption whilst managing multiple workstreams, timelines, and dependencies

- Track project milestones, risks, budgets, and provide strategic reporting to enhance organisational security posture
Vendor & Contract Management

- Manage cybersecurity vendors including awareness platforms, incident response partners, and security solution providers

- Oversee contract renewals, performance reviews, SLAs, and procurement processes whilst ensuring compliance with internal and regulatory requirements

- Conduct comprehensive vendor evaluations, manage security clearance requirements, and coordinate procurement processes
Governance, Programme and Agile Delivery

- Lead complex, multi-year technology delivery across MAS, aligned with business objectives and approved scope, budget, timelines and risk appetite.

- Act as programme secretariat and delivery lead for steering committees and workstreams, with clear terms of reference, decision rights, ownership, governance cadences and escalation paths.

- Maintain integrated delivery plans, Agile backlogs, decision records, financial and resource forecasts, action tracking and executive reporting.

- Apply fit-for-purpose Agile methods, tools, ceremonies and metrics to improve delivery flow, transparency, quality and continuous improvement while meeting MAS governance and assurance requirements.

- Facilitate architecture, risk, funding and delivery forums, presenting options, dependencies, impacts and recommendations to support timely decisions.

- Align business, technology, cybersecurity, procurement, legal, risk, audit and operations stakeholders around outcomes, user needs and acceptance criteria, removing barriers across teams.
Requirements, Service Design and Migration Planning

- Elicit, analyse, scope and manage business, technical, security and operational requirements, translating them into prioritised user stories, technical specifications and measurable acceptance criteria.

- Define the service vision, target operating model, delivery strategy and roadmap for quantum-safe capabilities using service-design and user-centred approaches where appropriate.

- Maintain an integrated dependency map covering business services, applications, infrastructure, data flows, cryptographic assets, certificates, keys, protocols, libraries, hardware, third parties and change windows.

- Maintain a risk-based quantum migration register considering data sensitivity and retention, “harvest now, decrypt later” and “trust now, forge later” exposure, business criticality, algorithm and key usage, vendor readiness and remediation complexity.

- Translate the cryptographic inventory into prioritised migration waves, release plans, resource forecasts, budgets and cutover schedules, tracking remediation from discovery through decommissioning.

- Plan for crypto-agility, interoperability, rollback, business continuity and approved coexistence or hybrid approaches, with accountable owners, evidence, exceptions and residual-risk acceptance.
Procurement, Vendor and Supply-Chain Management

- Obtain, assess and periodically refresh supplier PQC roadmaps, supported algorithms, implementation timelines, product dependencies, upgrade paths and end-of-support dates.

- Coordinate proofs of concept and interoperability, performance, resilience and security testing before production adoption.

- Identify concentration, lock-in and supply-chain risks, maintaining contingency options where vendor readiness may affect critical milestones.
Standards, Policy and Horizon Scanning

- Monitor authoritative quantum-safe guidance and standards, including relevant Singapore guidance, NIST PQC standards and transition guidance, and applicable IETF protocol specifications.

- Maintain a standards watchlist distinguishing final standards from drafts and recording applicability, maturity, implementation implications and required programme decisions.

- Translate regulatory, policy, standards and industry developments into architecture guardrails, information-security controls, procurement requirements, migration patterns, backlog changes and stakeholder briefings.

- Benchmark deployment practices and lessons from financial services and critical infrastructure without treating emerging or draft guidance as approved production standards.

- Ensure delivery aligns with MAS quality management systems, information-security policies, technology risk requirements and relevant industry standards.
Technical Delivery, Assurance and Automation

- Coordinate cryptographic discovery, inventory validation and ownership attestation across on-premises, cloud, network, endpoint, application, data and operational technology environments.

- Define delivery gates and evidence-based acceptance criteria for solution design, threat modelling, interoperability, performance, resilience, security testing, privacy and operational readiness.

- Oversee pilots and migration waves, including environment readiness, change approvals, cutover, rollback, incident readiness, service transition, post-implementation review and benefits realisation.

- Integrate migration outputs with enterprise architecture, configuration and asset management, certificate and key management, vulnerability management, service management and audit evidence repositories.

- Use project-management tools and Agile metrics to report inventory coverage, ownership attestation, risk reduction, remediation completion, test pass rates, exceptions, vendor readiness, delivery velocity and milestone variance.

- Identify and drive responsible use of AI and automation for inventory analysis, evidence collection, reporting, workflow orchestration and control monitoring in accordance with MAS requirements.

[What we are looking for]

- At least 8 years of experience in technology project or programme management, with a strong background in Agile delivery, digital services, cybersecurity, infrastructure or cryptographic transformation in large-scale organisations.

- Bachelor's degree in a relevant field (e.g., Information Technology, Computer Science, Business, Communications, or related disciplines)

- Cybersecurity certifications (e.g., CISSP, CISM, Security+, GCIH, or equivalent)

- Project management certifications (e.g., PMP, PRINCE2, Agile/Scrum certifications)

- Proven track record of delivering complex technology programmes and managing scope, budget, schedules, dependencies, risks, quality and benefits in regulated or high-availability environments.

- Working knowledge of public-key infrastructure, TLS, certificates, key management, hardware security modules, cryptographic libraries, cloud and network security, crypto-agility and PQC migration concepts.

- Strong analytical, business-analysis and process-improvement capabilities, with proficiency in project-management tools, Agile metrics and evidence-based reporting.

- Excellent communication and stakeholder-management skills, including the ability to explain technical concepts, risks and options to non-technical and senior audiences.

- Demonstrated ability to manage vendors and outsourced delivery, develop tender requirements, evaluate proposals and hold suppliers accountable for quality and outcomes.

- Experience in service design, user-centred delivery, quality management systems, information-security policies and relevant industry standards.

- Relevant experience using AI and automation to improve operational effectiveness, productivity or security outcomes, with the ability to identify and drive further opportunities.

- Ability to work independently and assume responsibility for programme deliverables

- Detail oriented team player.

- Experience in reporting and dashboarding tools (e.g., JIRA, Excel, Power BI, Tableau).

- Experience with Agile/Scrum methodologies.

- Automation skills (e.g., Python, VBA, Power Automate, scripting) for process improvement and efficiency.

As part of the shortlisting process for this role, you may be required to complete a medical declaration and/or undergo further assessment.

This is 2-year contract position. All applicants will be notified on whether they are shortlisted or not within 4 weeks of the closing date of this job posting.