Assistant Director - Cyber Risk Mgmt & Compliance; Cluster CISO Office

The ideal candidate should possess at least 8-10 years of experience in IT, Information Security, or IT Audit, with a proven track record in team leadership, people management, and stakeholder engagement. The role involves leading and developing a team of Institution Security Officers, overseeing resource allocation and workload management across multiple cybersecurity initiatives, driving capability building through training and coaching, and fostering a high-performance culture focused on accountability, collaboration, and continuous improvement.

Lead and provide strategic direction to a team of Institution Security Officers responsible for protecting ICT systems, Operational Technology (OT), and Medical Devices (MD) across NUHS institutions. Act as the key cybersecurity advisor and liaison to senior management and stakeholders, driving cybersecurity governance, risk management, compliance, and incident response efforts to ensure risks are effectively identified, evaluated, and managed while supporting business and clinical objectives.

Below are the main areas of responsibilities for ISO:

• Review risk assessments for ICT, OT, and medical devices in accordance with the Healthcare Cybersecurity & Technology Risk Management Framework and IT Security Policies.
• Provide security risk opinions, advisories, and recommendations.
• Challenge and validate security risk remediation priorities based on identified risk findings.
• Ensure consistency across risk recommendations, balancing operational efficiency with cybersecurity requirements.

• Support security compliance program by assessing and validating adherence to policy requirements.
• Track all policy deviations and ensure timely renewal, implementation of mitigation plans, and eventual closure of each deviation.

• Support the institution’s incident response activities by assessing and classifying security incidents, initiating appropriate response actions, conducting impact assessments, containing and eradicating threats, coordinating recovery efforts, and performing post‑incident investigations.

• Cybersecurity awareness initiatives, audit support, and security activities associated with key system migrations, including Windows migrations and system go‑live events.

• At least 8+ years of experience in cybersecurity, preferably in healthcare or other regulated industries.
• People leadership and coaching.
• Knowledge of ICT, Operational Technology and Medical Device cybersecurity.
• Experience with Information and Cybersecurity concepts spanning infrastructure and application domains.
• Cybersecurity related certifications such as CISSP, CCSP, CISA, CISM, CRISC is preferred.