Lead Software Engineer

Responsibilities

• Own and evolve the security architecture for the TradeNet Critical Information Infrastructure (CII), covering trust boundaries, identity, segmentation, encryption, key management, Zero Trust principles, and blast-radius containment.
• Embed secure-by-design and resilient-by-design controls throughout architecture, solution design, development, and implementation.
• Work hands-on with engineering teams to implement security controls and improve secure coding practices.
• Maintain threat models using frameworks such as MITRE ATT&CK, covering supply-chain, advanced persistent, and nation-state threats.
• Design for high availability, recoverability, graceful degradation, disaster recovery, and containment to maintain national trade continuity during cyber incidents.
• Identify and address dependency, concentration, third-party, and supply-chain risks across the TradeNet ecosystem.
• Partner with the Singapore Customs ACISO to design the CII security boundary and multi-layered defensive architecture.
• Translate CSA CCoP v2 and WOG IM8 requirements into practical architecture and engineering controls.
• Determine which security controls can be inherited from the GovTech security technology stack and which must be built and owned by the TradeNet product team.
• Maintain clear documentation of security control ownership and the shared-responsibility model.
• Implement security controls as code, including policy-as-code, CI/CD security guardrails, automated security checks, and continuous control monitoring.
• Champion Secure SDLC and DevSecOps practices across engineering teams.
• Evaluate and recommend appropriate cybersecurity tools, technologies, and security architecture patterns.
• Participate in cybersecurity resilience exercises and incorporate findings into platform architecture and engineering improvements.
• Provide technical guidance for incident response, vulnerability assessments, and penetration testing where required.
• Mentor and coach engineers on secure coding, security architecture, threat modelling, and cybersecurity best practices.

Requirements

• 10+ years of cybersecurity experience, with strong hands-on experience in software engineering, security engineering, or security architecture.
• Must be technically hands-on and capable of designing secure systems, reviewing or writing code, and coaching engineering teams on secure development.
• Demonstrated experience designing and implementing security architecture for regulated, critical, large-scale, or enterprise platforms.
• Working knowledge of Singapore cybersecurity regulatory frameworks, particularly CSA CCoP v2 and WOG IM8
• Familiarity with security frameworks including MITRE ATT&CK, NIST, ISO 27001, and CIS Benchmarks.
• Strong understanding of system boundaries, dependencies, failure modes, recoverability, and security risks across complex platforms.
• Proficiency in at least one scripting or automation language such as Python, TypeScript, Shell/Bash, or equivalent.
• Preferably proficient in Kotlin/JVM and TypeScript.
• Experience with government, CII, financial services, national infrastructure, or other mission-critical environments is advantageous.
• Cybersecurity architecture certifications such as CISSP / CISSP-ISSAP, SABSA, or cloud security certifications are advantageous.
• Must be eligible for the required personnel security clearance / CII vetting.
• Onsite presence during fixed hours may be required due to the critical nature of the role.

Strong knowledge of:

• Cloud security across IaaS, PaaS, and SaaS
• Identity and access management
• Encryption and key management
• Network segmentation and Zero Trust
• Secure SDLC and DevSecOps
• Policy-as-code and security automation
• Resilience, disaster recovery, and business continuity