Security Consultant (Contract)

[What the role is]

As a Security Consultant, you will drive and deliver a multi-year quantum-safe migration programme across MAS.

Working with cross-functional stakeholders, you will define scope, manage schedules and dependencies, track risks and issues, and report progress to leadership.

[What you will be working on]

Cybersecurity Project Management

• •Lead and manage cybersecurity projects across the organisation, including tool implementation, process improvements, and compliance initiatives
• •Collaborate with business units to ensure successful delivery and adoption whilst managing multiple workstreams, timelines, and dependencies
• •Track project milestones, risks, budgets, and provide strategic reporting to enhance organisational security posture

Vendor & Contract Management

• •Manage cybersecurity vendors including awareness platforms, incident response partners, and security solution providers
• •Oversee contract renewals, performance reviews, SLAs, and procurement processes whilst ensuring compliance with internal and regulatory requirements
• •Conduct comprehensive vendor evaluations, manage security clearance requirements, and coordinate procurement processes

Governance, Programme and Agile Delivery

• •Lead complex, multi-year technology delivery across MAS, aligned with business objectives and approved scope, budget, timelines and risk appetite.
• •Act as programme secretariat and delivery lead for steering committees and workstreams, with clear terms of reference, decision rights, ownership, governance cadences and escalation paths.
• •Maintain integrated delivery plans, Agile backlogs, decision records, financial and resource forecasts, action tracking and executive reporting.
• •Apply fit-for-purpose Agile methods, tools, ceremonies and metrics to improve delivery flow, transparency, quality and continuous improvement while meeting MAS governance and assurance requirements.
• •Facilitate architecture, risk, funding and delivery forums, presenting options, dependencies, impacts and recommendations to support timely decisions.
• •Align business, technology, cybersecurity, procurement, legal, risk, audit and operations stakeholders around outcomes, user needs and acceptance criteria, removing barriers across teams.

Requirements, Service Design and Migration Planning

• •Elicit, analyse, scope and manage business, technical, security and operational requirements, translating them into prioritised user stories, technical specifications and measurable acceptance criteria.
• •Define the service vision, target operating model, delivery strategy and roadmap for quantum-safe capabilities using service-design and user-centred approaches where appropriate.
• •Maintain an integrated dependency map covering business services, applications, infrastructure, data flows, cryptographic assets, certificates, keys, protocols, libraries, hardware, third parties and change windows.
• •Maintain a risk-based quantum migration register considering data sensitivity and retention, “harvest now, decrypt later” and “trust now, forge later” exposure, business criticality, algorithm and key usage, vendor readiness and remediation complexity.
• •Translate the cryptographic inventory into prioritised migration waves, release plans, resource forecasts, budgets and cutover schedules, tracking remediation from discovery through decommissioning.
• •Plan for crypto-agility, interoperability, rollback, business continuity and approved coexistence or hybrid approaches, with accountable owners, evidence, exceptions and residual-risk acceptance.

Procurement, Vendor and Supply-Chain Management

• •Obtain, assess and periodically refresh supplier PQC roadmaps, supported algorithms, implementation timelines, product dependencies, upgrade paths and end-of-support dates.
• •Coordinate proofs of concept and interoperability, performance, resilience and security testing before production adoption.
• •Identify concentration, lock-in and supply-chain risks, maintaining contingency options where vendor readiness may affect critical milestones.

Standards, Policy and Horizon Scanning

• •Monitor authoritative quantum-safe guidance and standards, including relevant Singapore guidance, NIST PQC standards and transition guidance, and applicable IETF protocol specifications.
• •Maintain a standards watchlist distinguishing final standards from drafts and recording applicability, maturity, implementation implications and required programme decisions.
• •Translate regulatory, policy, standards and industry developments into architecture guardrails, information-security controls, procurement requirements, migration patterns, backlog changes and stakeholder briefings.
• •Benchmark deployment practices and lessons from financial services and critical infrastructure without treating emerging or draft guidance as approved production standards.
• •Ensure delivery aligns with MAS quality management systems, information-security policies, technology risk requirements and relevant industry standards.

Technical Delivery, Assurance and Automation

• •Coordinate cryptographic discovery, inventory validation and ownership attestation across on-premises, cloud, network, endpoint, application, data and operational technology environments.
• •Define delivery gates and evidence-based acceptance criteria for solution design, threat modelling, interoperability, performance, resilience, security testing, privacy and operational readiness.
• •Oversee pilots and migration waves, including environment readiness, change approvals, cutover, rollback, incident readiness, service transition, post-implementation review and benefits realisation.
• •Integrate migration outputs with enterprise architecture, configuration and asset management, certificate and key management, vulnerability management, service management and audit evidence repositories.
• •Use project-management tools and Agile metrics to report inventory coverage, ownership attestation, risk reduction, remediation completion, test pass rates, exceptions, vendor readiness, delivery velocity and milestone variance.
• •Identify and drive responsible use of AI and automation for inventory analysis, evidence collection, reporting, workflow orchestration and control monitoring in accordance with MAS requirements.

[What we are looking for]

• •At least 8 years of experience in technology project or programme management, with a strong background in Agile delivery, digital services, cybersecurity, infrastructure or cryptographic transformation in large-scale organisations.
• •Bachelor's degree in a relevant field (e.g., Information Technology, Computer Science, Business, Communications, or related disciplines)
• •Cybersecurity certifications (e.g., CISSP, CISM, Security+, GCIH, or equivalent)
• •Project management certifications (e.g., PMP, PRINCE2, Agile/Scrum certifications)
• •Proven track record of delivering complex technology programmes and managing scope, budget, schedules, dependencies, risks, quality and benefits in regulated or high-availability environments.
• •Working knowledge of public-key infrastructure, TLS, certificates, key management, hardware security modules, cryptographic libraries, cloud and network security, crypto-agility and PQC migration concepts.
• •Strong analytical, business-analysis and process-improvement capabilities, with proficiency in project-management tools, Agile metrics and evidence-based reporting.
• •Excellent communication and stakeholder-management skills, including the ability to explain technical concepts, risks and options to non-technical and senior audiences.
• •Demonstrated ability to manage vendors and outsourced delivery, develop tender requirements, evaluate proposals and hold suppliers accountable for quality and outcomes.
• •Experience in service design, user-centred delivery, quality management systems, information-security policies and relevant industry standards.
• •Relevant experience using AI and automation to improve operational e