Lead Engineer/ Engineer, IT Services Ops, Central Services, ICT Infra

What The Role Is HTX is Singapore's Science and Technology agency that brings together diverse scientific and engineering capabilities to develop transformative, operationally ready solutions for public safety. As a statutory board under the Ministry of Home Affairs, HTX works at the forefront of science and technology to empower the Home Team with cutting-edge capabilities. Guided by our mission to amplify, augment and accelerate the Home Team's advantage, we are committed to keeping Singapore the safest place on planet Earth.

The ICT Infrastructure Sustainment Centre is dedicated to delivering robust and reliable information and communication technology (ICT) infrastructure solutions that empower the operations of the Ministry of Home Affairs (MHA).

The ICT Infra Ransomware Attack Recovery Engineer is responsible for developing, implementing, and maintaining comprehensive ransomware attack recovery strategies for enterprise ICT infrastructure across all Home Team Departments (HTDs). This role requires deep expertise in cybersecurity, incident response, and disaster recovery, with a focus on ensuring operational continuity and rapid recovery from ransomware threats. The engineer will lead cross-departmental initiatives, mentor and vendors teams, and drive innovation in ransomware resilience.

What You Will Be Working On

• Conduct ransomware risk assessments and vulnerability management across on-premises, cloud, and hybrid environments.
• Design and implement robust ransomware recovery plans, including backup strategies, disaster recovery procedures, and incident response protocols.
• Deploy and manage advanced monitoring tools to detect ransomware indicators and anomalous activities.
• Lead and coordinate ransomware incident response efforts, manage communications during incidents, and conduct post-incident analysis.
• Ensure ransomware recovery capabilities align with government cybersecurity policies, standards, and guidelines.
• Evaluate and recommend ransomware recovery technologies and vendor solutions.
• Develop and conduct ransomware awareness training for technical teams and end users.
• Manage contracts for ransomware recovery solutions and participate in procurement processes.
• Maintain detailed documentation of recovery procedures, incident response playbooks, and performance metrics.

What We Are Looking For Qualifications & Experience

• Tertiary qualification in Computer Science, Cybersecurity, Information Systems, Electronics/Electrical Engineering, or related disciplines.
• Minimum 5 years of experience in cybersecurity, with a specific focus on ransomware recovery, incident response, business continuity planning, or disaster recovery management.
• Professional certifications such as CISSP, CISM, GCIH, GCFA, or equivalent are advantageous.
• In-depth understanding of ransomware attack vectors, recovery methodologies, backup technologies, and enterprise infrastructure.
• Strong knowledge of cybersecurity frameworks (NIST, ISO 27001, Singapore Government policies).
• Experience with security monitoring tools, SIEM platforms, endpoint detection and response, and backup/recovery technologies.
• Effective communication skills for technical and non-technical audiences.
• Demonstrated ability to work under pressure during security incidents and coordinate cross-functional teams.
• Experience in vendor management, contract negotiation, and procurement for cybersecurity solutions.
• Project management skills and willingness to participate in 24/7 incident response activities.

Personal Characteristics & Behaviours

• Excellence in crisis communication, stakeholder management, and incident coordination.
• Strong troubleshooting and investigation skills and ability to guide vendors and contractors through high-stress security incidents.
• Proactive, resilient, and adaptable in rapidly evolving cybersecurity threat landscapes.
• High ethical standards and discretion when handling sensitive security information.
• Continuous learning mindset to stay current with emerging ransomware threats and recovery techniques.

All new hires are appointed on a two-year contract in the first instance and will be assessed and considered for permanent tenure over time, based on performance.

As part of the shortlisting process for this role, you may be required to complete a medical declaration and/or undergo further assessment.

All applicants will be updated on the status of their applications within 4 weeks upon closing of the advertisement.