Security Consultant (Contract)

[What the role is]
As a Security Consultant, you will drive and deliver a multi-year quantum-safe migration programme across MAS.

Working with cross-functional stakeholders, you will define scope, manage schedules and dependencies, track risks and issues, and report progress to leadership.

[What you will be working on]

Cybersecurity Project Management

- Lead and manage cybersecurity projects across the organisation, including tool implementation, process improvements, and compliance initiatives
- Collaborate with business units to ensure successful delivery and adoption whilst managing multiple workstreams, timelines, and dependencies
- Track project milestones, risks, budgets, and provide strategic reporting to enhance organisational security posture

Vendor & Contract Management

- Manage cybersecurity vendors including awareness platforms, incident response partners, and security solution providers
- Oversee contract renewals, performance reviews, SLAs, and procurement processes whilst ensuring compliance with internal and regulatory requirements
- Conduct comprehensive vendor evaluations, manage security clearance requirements, and coordinate procurement processes

Governance, Programme and Agile Delivery

- Lead complex, multi-year technology delivery across MAS, aligned with business objectives and approved scope, budget, timelines and risk appetite.
- Act as programme secretariat and delivery lead for steering committees and workstreams, with clear terms of reference, decision rights, ownership, governance cadences and escalation paths.
- Maintain integrated delivery plans, Agile backlogs, decision records, financial and resource forecasts, action tracking and executive reporting.
- Apply fit-for-purpose Agile methods, tools, ceremonies and metrics to improve delivery flow, transparency, quality and continuous improvement while meeting MAS governance and assurance requirements.
- Facilitate architecture, risk, funding and delivery forums, presenting options, dependencies, impacts and recommendations to support timely decisions.
- Align business, technology, cybersecurity, procurement, legal, risk, audit and operations stakeholders around outcomes, user needs and acceptance criteria, removing barriers across teams.

Requirements, Service Design and Migration Planning

- Elicit, analyse, scope and manage business, technical, security and operational requirements, translating them into prioritised user stories, technical specifications and measurable acceptance criteria.
- Define the service vision, target operating model, delivery strategy and roadmap for quantum-safe capabilities using service-design and user-centred approaches where appropriate.
- Maintain an integrated dependency map covering business services, applications, infrastructure, data flows, cryptographic assets, certificates, keys, protocols, libraries, hardware, third parties and change windows.
- Maintain a risk-based quantum migration register considering data sensitivity and retention, “harvest now, decrypt later” and “trust now, forge later” exposure, business criticality, algorithm and key usage, vendor readiness and remediation complexity.
- Translate the cryptographic inventory into prioritised migration waves, release plans, resource forecasts, budgets and cutover schedules, tracking remediation from discovery through decommissioning.
- Plan for crypto-agility, interoperability, rollback, business continuity and approved coexistence or hybrid approaches, with accountable owners, evidence, exceptions and residual-risk acceptance.

Procurement, Vendor and Supply-Chain Management

- Obtain, assess and periodically refresh supplier PQC roadmaps, supported algorithms, implementation timelines, product dependencies, upgrade paths and end-of-support dates.
- Coordinate proofs of concept and interoperability, performance, resilience and security testing before production adoption.
- Identify concentration, lock-in and supply-chain risks, maintaining contingency options where vendor readiness may affect critical milestones.

Standards, Policy and Horizon Scanning

- Monitor authoritative quantum-safe guidance and standards, including relevant Singapore guidance, NIST PQC standards and transition guidance, and applicable IETF protocol specifications.
- Maintain a standards watchlist distinguishing final standards from drafts and recording applicability, maturity, implementation implications and required programme decisions.
- Translate regulatory, policy, standards and industry developments into architecture guardrails, information-security controls, procurement requirements, migration patterns, backlog changes and stakeholder briefings.
- Benchmark deployment practices and lessons from financial services and critical infrastructure without treating emerging or draft guidance as approved production standards.
- Ensure delivery aligns with MAS quality management systems, information-security policies, technology risk requirements and relevant industry standards.

Technical Delivery, Assurance and Automation

- Coordinate cryptographic discovery, inventory validation and ownership attestation across on-premises, cloud, network, endpoint, application, data and operational technology environments.
- Define delivery gates and evidence-based acceptance criteria for solution design, threat modelling, interoperability, performance, resilience, security testing, privacy and operational readiness.
- Oversee pilots and migration waves, including environment readiness, change approvals, cutover, rollback, incident readiness, service transition, post-implementation review and benefits realisation.
- Integrate migration outputs with enterprise architecture, configuration and asset management, certificate and key management, vulnerability management, service management and audit evidence repositories.
- Use project-management tools and Agile metrics to report inventory coverage, ownership attestation, risk reduction, remediation completion, test pass rates, exceptions, vendor readiness, delivery velocity and milestone variance.
- Identify and drive responsible use of AI and automation for inventory analysis, evidence collection, reporting, workflow orchestration and control monitoring in accordance with MAS requirements.

[What we are looking for]

- At least 8 years of experience in technology project or programme management, with a strong background in Agile delivery, digital services, cybersecurity, infrastructure or cryptographic transformation in large-scale organisations.
- Bachelor's degree in a relevant field (e.g., Information Technology, Computer Science, Business, Communications, or related disciplines)
- Cybersecurity certifications (e.g., CISSP, CISM, Security+, GCIH, or equivalent)
- Project management certifications (e.g., PMP, PRINCE2, Agile/Scrum certifications)
- Proven track record of delivering complex technology programmes and managing scope, budget, schedules, dependencies, risks, quality and benefits in regulated or high-availability environments.
- Working knowledge of public-key infrastructure, TLS, certificates, key management, hardware security modules, cryptographic libraries, cloud and network security, crypto-agility and PQC migration concepts.
- Strong analytical, business-analysis and process-improvement capabilities, with proficiency in project-management tools, Agile metrics and evidence-based reporting.
- Excellent communication and stakeholder-management skills, including the ability to explain technical concepts, risks and options to non-technical and senior audiences.
- Demonstrated ability to manage vendors and outsourced delivery, develop tender requirements, evaluate proposals and hold suppliers accountable for quality and outcomes.
- Experience in service design, user-centred delivery, quality management systems, information-security policies and relevant industry standards.
- Relevant experience using AI and automation to improve operational effectiveness, productivity or security outcomes, with the ability to identify and drive further opportunities.
- Ability to work independently and assume responsibility for programme deliverables
- Detail oriented team player.
- Experience in reporting and dashboarding tools (e.g., JIRA, Excel, Power BI, Tableau).
- Experience with Agile/Scrum methodologies.
- Automation skills (e.g., Python, VBA, Power Automate, scripting) for process improvement and efficiency.

As part of the shortlisting process for this role, you may be required to complete a medical declaration and/or undergo further assessment.

This is 2-year contract position. All applicants will be notified on whether they are shortlisted or not within 4 weeks of the closing date of this job posting.