Security Consultant (Contract)

As a Security Consultant, you will drive and deliver a multi-year quantum-safe migration programme across MAS. Working with cross-functional stakeholders, you will define scope, manage schedules and dependencies, track risks and issues, and report progress to leadership. Responsibilities Cybersecurity Project Management • Lead and manage cybersecurity projects across the organisation, including tool implementation, process improvements, and compliance initiatives • Collaborate with business units to ensure successful delivery and adoption whilst managing multiple workstreams, timelines, and dependencies • Track project milestones, risks, budgets, and provide strategic reporting to enhance organisational security posture Vendor & Contract Management • Manage cybersecurity vendors including awareness platforms, incident response partners, and security solution providers • Oversee contract renewals, performance reviews, SLAs, and procurement processes whilst ensuring compliance with internal and regulatory requirements • Conduct comprehensive vendor evaluations, manage security clearance requirements, and coordinate procurement processes Governance, Programme and Agile Delivery • Lead complex, multi-year technology delivery across MAS, aligned with business objectives and approved scope, budget, timelines and risk appetite. • Act as programme secretariat and delivery lead for steering committees and workstreams, with clear terms of reference, decision rights, ownership, governance cadences and escalation paths. • Maintain integrated delivery plans, Agile backlogs, decision records, financial and resource forecasts, action tracking and executive reporting. • Apply fit-for-purpose Agile methods, tools, ceremonies and metrics to improve delivery flow, transparency, quality and continuous improvement while meeting MAS governance and assurance requirements. • Facilitate architecture, risk, funding and delivery forums, presenting options, dependencies, impacts and recommendations to support timely decisions. • Align business, technology, cybersecurity, procurement, legal, risk, audit and operations stakeholders around outcomes, user needs and acceptance criteria, removing barriers across teams. Requirements, Service Design and Migration Planning • Elicit, analyse, scope and manage business, technical, security and operational requirements, translating them into prioritised user stories, technical specifications and measurable acceptance criteria. • Define the service vision, target operating model, delivery strategy and roadmap for quantum-safe capabilities using service-design and user-centred approaches where appropriate. • Maintain an integrated dependency map covering business services, applications, infrastructure, data flows, cryptographic assets, certificates, keys, protocols, libraries, hardware, third parties and change windows. • Maintain a risk-based quantum migration register considering data sensitivity and retention, “harvest now, decrypt later” and “trust now, forge later” exposure, business criticality, algorithm and key usage, vendor readiness and remediation complexity. • Translate the cryptographic inventory into prioritised migration waves, release plans, resource forecasts, budgets and cutover schedules, tracking remediation from discovery through decommissioning. • Plan for crypto-agility, interoperability, rollback, business continuity and approved coexistence or hybrid approaches, with accountable owners, evidence, exceptions and residual-risk acceptance. Procurement, Vendor and Supply-Chain Management • Obtain, assess and periodically refresh supplier PQC roadmaps, supported algorithms, implementation timelines, product dependencies, upgrade paths and end-of-support dates. • Coordinate proofs of concept and interoperability, performance, resilience and security testing before production adoption. • Identify concentration, lock-in and supply-chain risks, maintaining contingency options where vendor readiness may affect critical milestones. Standards, Policy and Horizon Scanning • Monitor authoritative quantum-safe guidance and standards, including relevant Singapore guidance, NIST PQC standards and transition guidance, and applicable IETF protocol specifications. • Maintain a standards watchlist distinguishing final standards from drafts and recording applicability, maturity, implementation implications and required programme decisions. • Translate regulatory, policy, standards and industry developments into architecture guardrails, information-security controls, procurement requirements, migration patterns, backlog changes and stakeholder briefings. • Benchmark deployment practices and lessons from financial services and critical infrastructure without treating emerging or draft guidance as approved production standards. • Ensure delivery aligns with MAS quality management systems, information-security policies, technology risk requirements and relevant industry standards. Technical Delivery, Assurance and Automation • Coordinate cryptographic discovery, inventory validation and ownership attestation across on-premises, cloud, network, endpoint, application, data and operational technology environments. • Define delivery gates and evidence-based acceptance criteria for solution design, threat modelling, interoperability, performance, resilience, security testing, privacy and operational readiness. • Oversee pilots and migration waves, including environment readiness, change approvals, cutover, rollback, incident readiness, service transition, post-implementation review and benefits realisation. • Integrate migration outputs with enterprise architecture, configuration and asset management, certificate and key management, vulnerability management, service management and audit evidence repositories. • Use project-management tools and Agile metrics to report inventory coverage, ownership attestation, risk reduction, remediation completion, test pass rates, exceptions, vendor readiness, delivery velocity and milestone variance. • Identify and drive responsible use of AI and automation for inventory analysis, evidence collection, reporting, workflow orchestration and control monitoring in accordance with MAS requirements. Requirements • At least 8 years of experience in technology project or programme management, with a strong background in Agile delivery, digital services, cybersecurity, infrastructure or cryptographic transformation in large-scale organisations. • Bachelor's degree in a relevant field (e.g., Information Technology, Computer Science, Business, Communications, or related disciplines) • Cybersecurity certifications (e.g., CISSP, CISM, Security+, GCIH, or equivalent) • Project management certifications (e.g., PMP, PRINCE2, Agile/Scrum certifications) • Proven track record of delivering complex technology programmes and managing scope, budget, schedules, dependencies, risks, quality and benefits in regulated or high-availability environments. • Working knowledge of public-key infrastructure, TLS, certificates, key management, hardware security modules, cryptographic libraries, cloud and network security, crypto-agility and PQC migration concepts. • Strong analytical, business-analysis and process-improvement capabilities, with proficiency in project-management tools, Agile metrics and evidence-based reporting. • Excellent communication and stakeholder-management skills, including the ability to explain technical concepts, risks and options to non-technical and senior audiences. • Demonstrated ability to manage vendors and outsourced delivery, develop tender requirements, evaluate proposals and hold suppliers accountable for quality and outcomes. • Experience in service design, user-centred delivery, quality management systems, information-security policies and relevant industry standards. • Relevant experience using AI and automation to improve operational effectiveness, productivity or security outcomes, with the ability to identify and drive further opportunities. • Ability to work independently and assume responsibility for programme deliverables • Detail oriented team player. • Experience in reporting and dashboarding tools (e.g., JIRA, Excel, Power BI, Tableau). • Experience with Agile/Scrum methodologies. • Automation skills (e.g., Python, VBA, Power Automate, scripting) for process improvement and efficiency. As part of the shortlisting process for this role, you may be required to complete a medical declaration and/or undergo further assessment. This is 2-year contract position. All applicants will be notified on whether they are shortlisted or not within 4 weeks of the closing date of this job posting.