Information Security Associate

Role Summary

We are seeking a motivated and technically skilled Information Security Associate to join our cybersecurity team. The role is suitable for an early to mid-career information security professional with hands-on experience in security testing, vulnerability assessment, and security operations, along with an interest in Governance, Risk & Compliance (GRC).

The successful candidate will support the organization's information security posture through vulnerability assessments, penetration testing, threat analysis, security monitoring, risk assessments, and compliance activities. The role will also contribute to ISO 27001, data privacy, and information security governance initiatives.

Key Responsibilities

Technical Security Operations

• Conduct vulnerability assessments and support VAPT activities across networks, applications, systems, mobile applications, and cloud environments.
• Identify, validate, prioritize, and report security vulnerabilities and misconfigurations.
• Support penetration testing and security assessment activities using appropriate tools and methodologies.
• Participate in red team, blue team, tabletop exercises, security simulations, and cyber resilience assessments.
• Analyze security events, indicators of compromise, and attack techniques to identify potential security risks.
• Support remediation activities by coordinating with infrastructure, application, and business teams.
• Conduct security reviews of applications, systems, infrastructure, and technology implementations.
• Assist with threat modelling and security risk assessments for new projects and technology deployments.
• Investigate network-related security issues, including DNS activity, suspicious communications, and traffic anomalies.
• Support security monitoring, incident analysis, and root cause investigations when required.
• Maintain security testing methodologies, procedures, and technical documentation.

Governance, Risk & Compliance

• Support the implementation and maintenance of information security policies, standards, and procedures.
• Assist with information security risk assessments, risk treatment, and risk tracking.
• Contribute to ISO 27001 compliance and continuous improvement initiatives.
• Support internal and external audits, compliance reviews, and evidence collection.
• Assist in maintaining security controls aligned with regulatory and organizational requirements.
• Support privacy and data protection assessments, including PDPA and other applicable requirements.
• Track security findings, corrective actions, and compliance remediation activities.
• Contribute to security awareness, governance documentation, and information security communications.

Documentation & Reporting

• Prepare and maintain vulnerability assessment, penetration testing, risk assessment, and security review reports.
• Maintain risk registers, security findings, remediation trackers, and compliance records.
• Ensure accurate and consistent documentation of security activities and control validation.
• Communicate technical security findings clearly to both technical and non-technical stakeholders.
• Contribute to continuous improvement of information security processes and procedures.

Desired Candidate Profile

Required Qualifications

Education

• Bachelor's degree in Cybersecurity, Information Security, Computer Science, Information Technology, Network Engineering, or a related discipline.

Experience

• 2–5 years of relevant experience in information security, cybersecurity operations, vulnerability management, security assessment, or related areas.
• Hands-on experience in Vulnerability Assessment and Penetration Testing (VAPT).
• Experience identifying and evaluating vulnerabilities across infrastructure, applications, mobile applications, and network environments.
• Exposure to security assessment methodologies and common cybersecurity attack techniques.
• Working knowledge of security frameworks, risk management, and GRC principles.

Technical Skills

• Vulnerability management and remediation processes.
• Penetration testing tools and security assessment methodologies.
• Network security fundamentals, including TCP/IP, DNS, routing, switching, and firewalls.
• Understanding of common web application and infrastructure vulnerabilities.
• Ability to analyse technical security findings and assess associated business risks.
• Basic knowledge of SIEM and security monitoring technologies.
• Working knowledge of ISO 27001 controls and Information Security Management Systems (ISMS).
• Understanding of data protection and privacy requirements, including PDPA and related regulations.
• Basic understanding of cloud security concepts and cloud environments.

Preferred Qualifications

• Experience participating in red team, blue team, tabletop, or adversary simulation exercises.
• Hands-on experience with network traffic analysis and DNS security investigations.
• Experience with SIEM platforms and security monitoring tools.
• Exposure to cloud security technologies and environments.
• Experience supporting ISO 27001 audits, risk assessments, or compliance programs.
• Knowledge of additional cybersecurity, risk, compliance, or privacy frameworks.
• Relevant professional certifications such as CEH, Security+, ISO 27001, OSCP, or equivalent would be an advantage.

Core Competencies

• Strong analytical and problem-solving skills.
• Attention to detail and strong documentation skills.
• Strong technical curiosity and willingness to learn.
• Ability to work collaboratively with technical and business stakeholders.
• Ability to translate technical security findings into business risks.
• Strong written and verbal communication skills.
• Process-oriented and organized approach to security activities.