Information Security Manager (ISM)

About this role

HeritageSG (HSG) is seeking an Information Security Manager (ISM) to support the governance, implementation, and continuous improvement of HSG's ICT security posture. Operating under HSG's Policy on ICT Security within the Digitalisation Steering Committee (DSC) governance framework, the ISM helps ensure that HSG's systems, digital platforms, museum interactives, and corporate environment remain secure, compliant, and audit-ready.

The role is hands-on and delivery-focused: the successful candidate will work closely with Head of Digital Services, the IT Lead, the Managed Service Provider (MSP), project teams, and NHB / GovTech counterparts, with mentoring, training, and oversight provided.

This is an executive-level position suited to an early-career security practitioner with at least one year of relevant experience. The ISM is expected to grow into broader security governance responsibilities over time.

Key Responsibilities

ICT Security Governance, Strategy and Policy

• Support the maintenance of HSG's ICT security strategy and annual security work plan, aligned to Whole of Government’s IM8 guidance.
• Assist in reviewing and maintaining HSG's ICT security policies, standards, SOPs, and guidelines, and support annual policy review cycles.
• Maintain an overall view of the ICT security design, implementation, and operations across HSG's systems.

Risk Management and Assurance

• Facilitate ICT security risk assessments for systems and projects at design, before go-live, after material change, and at least annually.
• Maintain the ICT Security Risk Register, exception register, and records of waivers, risk acceptance, and corrective action plans.
• Support residual-risk treatment and ensure risks are accepted by the appropriate HSG approving authority.

Security Testing and Secure Project Delivery

• Review VAPT, Penetration Test, and Source Code Review scoping, findings, remediation, and closure evidence, and confirm mitigations are performed satisfactorily.
• Provide security input for HSG projects (e.g. digital signage, museum interactives, campaign and festival websites, cloud / SaaS systems).
• Serve as the designated security representative in project governance, taking up and being accountable for assigned security risk items and clearances within Project Steering Committee (PSC), Project Management Team (PMT), and Business Functional Group (BFG) submissions.
• Assess and record the security position on project papers (e.g. "supported", or residual risk accepted with basis), including go-live clearances and risk-acceptance recommendations, and maintain the supporting evidence.
• Escalate security decisions that exceed the postholder's delegated authority (e.g. higher-severity residual-risk acceptance) to HSG CIO, DSC, and/or NHB CISO as appropriate.

Security Operations and Endpoint Baseline Governance

• Monitor endpoint security posture, configuration compliance, and drift via Microsoft Intune, Microsoft Defender for Endpoint, and Check Point Harmony Endpoint.
• Maintain endpoint baseline registers (Microsoft Security Baselines / CIS benchmarks for Windows and macOS), deviation registers, and periodic reviews.

Vulnerability Management and ARC Reporting

• Consolidate quarterly ARC-ready vulnerability reporting, including scan coverage, open vulnerabilities by severity, patch compliance / ageing patches, and notable advisories and exceptions.
• Prepare and submit the recurring Quarterly Cybersecurity Incident Report to the ARC, and maintain supporting evidence, trackers, and templates.

Threat and Incident Management

• Act as first point of escalation, i.e., triage, classify, and coordinate containment and recovery for cybersecurity incidents and endpoint / M365 alerts.
• Support the incident response process, including HSG’s vendor’s  (Blackpanda) Incident Response arrangement, and coordinate with NHB CISO / GovTech (GIROC / GITSIR) where required.
• Support incident response workshops, table-top exercises, and drills.

Audit, Compliance and Evidence Management

• Support ITGC, cybersecurity, and data protection audit remediation and closure of audit findings, working with internal auditors.
• Maintain audit-related evidence: user access reviews, vendor access approvals, log review sign-offs, and exception records.

Security Awareness and Culture

• Support ICT security awareness and education for HSG staff, vendors, and third parties, and help drive secure development and management practices.

Required Qualifications and Experience

• A recognised diploma or degree in Information Security, Computer Science, Information Technology, or a related field.
• At least one (1) year of relevant experience in information security, cybersecurity, IT risk, IT audit, or security operations.
• Working knowledge of the Microsoft 365 / Microsoft Defender / Intune / Entra ID security ecosystem is an advantage.
• Familiarity with security frameworks and baselines (e.g. IM8, NIST, ISO 27001, CIS benchmarks) is an advantage.
• An entry-level security certification (e.g. CompTIA Security+, and/or working towards CISM / CISSP-track qualifications) is desirable but not mandatory.

Key Competencies

Security fundamentals: Sound grasp of core security concepts: access control, patching, hardening, vulnerability and incident basics.

Risk and compliance mindset: Able to follow risk assessment and audit processes, document evidence, and maintain registers accurately.

Attention to detail: Produces audit-ready, traceable documentation and reporting.

Communication: Communicates security matters clearly to technical and non-technical stakeholders; drafts submissions and reports.

Collaboration: Works effectively with the CIO, IT Lead, MSP, project teams, and NHB / GovTech counterparts.

Learning agility: Willing to be mentored and to grow into broader ISM / security governance responsibilities.

Why Join HeritageSG?

Be Part of Singapore's Creative Heritage Force As a subsidiary of the National Heritage Board under MCCY, HeritageSG stands at the forefront of cultural innovation. We're the creative minds transforming how heritage connects with contemporary audiences.

Shape the Future of Cultural Experiences Join a dynamic team that blends immersive storytelling with cutting-edge technology. From virtual reality installations to interactive displays, we're pioneering new ways to make heritage accessible and engaging across museums, festivals, and digital platforms.

Work Where Creativity Meets Impact At HeritageSG, every project matters. Whether you're curating exhibitions, coordinating festivals, or developing digital experiences, you'll contribute to thoughtfully curated experiences that bring heritage to life for millions. Our collaborative environment encourages creative thinking whilst maintaining the highest professional standards.

Grow Your Career in Cultural Innovation Be part of an organisation that values both tradition and innovation. You'll work alongside passionate professionals who are reshaping the cultural landscape, with opportunities to develop expertise across multiple disciplines – from traditional curation to emerging technologies.

Make Heritage Relevant for Tomorrow Join us in our mission to ensure heritage remains vibrant and meaningful for future generations. At HeritageSG, your work doesn't just preserve the past – it actively shapes how culture evolves and connects with contemporary society.