SVP, Exposure Management, Technology Group
- .
- Qualifications/Skills: list of qualifications/skills (15+ years etc). Could be Qualifications or Skills. We'll combine into Qualifications (or Skills). Probably Qualifications.
- Benefits: flexibility description (office 4 days per week, choose days). Also maybe PRIME values? But that's more culture. Could include Benefits as flexibility.
- Pay: anticipated base salary range $178,000-$255,000, bonuses based on performance.
- Schedule: maybe also flexibility? But schedule could be the office days (four days per week). Since we already used flexibility in Benefits, we could put Schedule as the same info? Might be redundant. Better to put Schedule as the office days detail, and Benefits as other benefits (maybe none). However we have only flexibility description; we could treat that as Schedule. Benefits could be omitted if no specific benefits like health etc. But we have flexibility as a benefit. The instruction: include a section ONLY when posting has real, specific content for it. So we need to decide which sections have content.
We have content for:
- About the role: yes.
- Responsibilities: yes.
- Qualifications: yes.
- Pay: yes (salary range, bonus).
- Schedule: yes (office four days per week, flexibility to choose days).
- Benefits: maybe not explicit beyond flexibility; but we could treat flexibility as Benefits? However we already have Schedule for that. Could we have Benefits empty? No, we must not emit heading with filler. So we omit Benefits.
Thus sections: About the role, Responsibilities, Qualifications, Pay, Schedule.
We need to use
for each heading. Use
- for any list of duties/requirements/benefits. For About the role we can use
. For Responsibilities we list bullet points. For Qualifications we list bullet points. For Pay we can use
with salary range and bonus. For Schedule we can use
describing office days. We must not repeat job title as heading. Not include Job ID etc. Remove boilerplate like EEO, equal opportunity, scam warning, navigation, cookie, legal, duplicated lines, application instructions. Also remove links? The posting includes a link to Learn more about our Technology Group. That's likely application instruction? It's not required to keep. We should remove it. Also remove "Learn more about our Technology Group here: https://gic.careers/group/technology-group/". Also remove "Our PRIME Values" maybe? That's values description; could be part of About the role? It's not specifically about role but could be included in About the role as culture. However we might keep it as part of About the role if it's substantive. The PRIME values description is generic but still part of posting. It's not boilerplate? It's values description. Could include in About the role as a paragraph. But we must not invent or summarize away detail. We can include it as part of About the role. Also "Work at the Point of Impact" heading appears; but we should not repeat job title. That's a phrase; we could treat as part of About the role. We need to preserve all substantive information. So we need to include details about GIC, Technology Group, ICR, CSAD, role impact, responsibilities list, qualifications list, compensation, schedule. Let's extract and rewrite. About the role paragraph: Combine description: GIC is one of the world’s largest sovereign wealth funds, over 2000 employees across 11 locations, invests in >40 countries globally across asset classes and businesses. Working at GIC gives exposure to network of world’s industry leaders. As a leading global long-term investor, we Work at the Point of Impact for Singapore’s financial future, and the communities we invest in worldwide. Technology Group (TG) is a key enabler... Infrastructure Cybersecurity & Resilience (ICR) mission... The individual will be part of the Cybersecurity Assurance & Defence (CSAD) team and will play a key role... What impact can you make in this role? This role will drive strategic and operational excellence needed to safeguard GIC’s technology ecosystem... (the impact paragraph). We'll include that as About the role. Responsibilities: bullet list of "What will you do as SVP Exposure Management?" items. Qualifications/Skills: bullet list of "What qualifications or skills should you possess in this role?" items. Pay: paragraph: "Our compensation philosophy... Total pay for this position comprises base pay and bonus. The anticipated base salary range for this role is between $178,000 and $255,000. Bonuses, which may form a meaningful proportion of the total pay package, are determined based on company and individual performance." Schedule: paragraph: "At GIC, our offices are vibrant hubs for ideation, professional growth, and interpersonal connection. At the same time, we believe that flexibility allows us to do our best work and be our best selves. Thus, our teams come into the office four days per week to harness the benefits of in-person collaboration, but have the flexibility to choose which days they work from home and adjust this arrangement as situational needs arise." We should also maybe include PRIME values? Could be part of About the role but it's a separate section "Our PRIME Values". Might be considered substantive. However we have limited sections; we could add a section "Values" but not in allowed headings list. The allowed headings list includes About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. No Values. So we should not create a Values heading. We could incorporate PRIME values into About the role as a paragraph. Thus final HTML fragment:
About the role
...
Responsibilities
- ... ...
Qualifications
- ... ...
Pay
...
Schedule
...
Make sure no extra whitespace? It's fine. Now craft the content precisely, preserving details. Let's write About the role paragraph: "GIC is one of the world’s largest sovereign wealth funds, with over 2,000 employees across 11 locations around the world, investing in more than 40 countries globally across asset classes and businesses. Working at GIC gives exposure to an extraordinary network of the world’s industry leaders. As a leading global long-term investor, we work at the Point of Impact for Singapore’s financial future and the communities we invest in worldwide. The Technology Group (TG) is a key enabler that constantly exploits state‑of‑the‑art information technologies to enhance GIC’s ability to be the leading global long‑term investment firm, aiming to provide users with empowering and transformational capabilities and to create an inclusive, innovative and integrated work environment. Infrastructure Cybersecurity & Resilience (ICR) seeks to fortify GIC's infrastructure and cybersecurity capabilities by embedding security and resilience into everything we do, providing stable, secure and dependable services and solutions. The individual will be part of the Cybersecurity Assurance & Defence (CSAD) team and will play a key role in strengthening the firm’s security posture through proactive vulnerability management, adversarial attack simulation planning, and continuous improvement of security. The individual will serve as a control owner, driving threat prioritization, root cause analysis, and cross‑team collaboration to remediate and prevent recurrence of vulnerabilities. This role will drive the strategic and operational excellence needed to safeguard GIC’s technology ecosystem. By leading efforts to identify, assess, and remediate vulnerabilities across infrastructure, applications, and cloud environments, the SVP will ensure proactive risk reduction and resilience against evolving cyber threats. The impact of this role will be seen in stronger enterprise‑wide security posture, improved regulatory and compliance alignment, and enhanced confidence among stakeholders that critical assets are protected through timely, data‑driven, and coordinated vulnerability management practices." That seems comprehensive. Now Responsibilities bullet list: need to capture each bullet from "What will you do as SVP Exposure Management?" Let's list them: - Define and execute the exposure and vulnerability management strategy, aligned with enterprise risk appetite, regulatory requirements, and business objectives. - Establish a forward-looking roadmap that operationalizes continuous threat management, integrating threat intelligence, security analytics, and automation to strengthen the discovery, prioritization, validation, and remediation of exposures. - Maintain continuous visibility of the enterprise attack surface — spanning external, cloud, on-premises, hybrid, and identity-based exposures — to move from reactive scanning to proactive exposure reduction. - Lead and govern scanning and assessment ensuring consistent standards, accuracy, timely mitigation, and transparent reporting. - Drive risk-based prioritization of vulnerabilities and exposures using threat context, exploitability, attack-path analysis, and business criticality — focusing remediation effort on what is genuinely exploitable and impactful. - Employ exposure validation techniques (e.g., attack path modelling, breach and attack simulation, and penetration testing) to confirm real-world risk and measure the effectiveness of controls. - Partner with technology teams to embed best practices into technology and orchestrate the mobilization and remediation of exposures across accountable owners. - Collaborate with risk and audit teams to align technical exposure and vulnerability management with broader risk management practices and act as a key point of contact for audit matters. - Communicate complex technical exposures to drive informed, risk-based decision-making at all levels of the firm. - Develop, update, and manage the firm's exposure, vulnerability, and security patch management standards. - Develop and track performance metrics, key risk indicators (KRIs), and key performance indicators (KPIs) to measure program maturity and impact. - Build and lead a high-performing team. - Drive continuous improvement of program processes, tooling, and automation to accelerate mean-time-to-remediate and reduce recurring exposures. - Stay abreast of global cybersecurity trends, emerging vulnerabilities, exploits, and regulatory developments. We'll put each as - . Now Qualifications bullet list from "What qualifications or skills should you possess in this role?": - 15+ years of experience in cybersecurity, with at least 7 years in senior leadership roles overseeing exposure and vulnerability management operations. - Proven experience establishing or maturing a threat exposure management or equivalent risk-based exposure management program at enterprise scale. - Deep understanding of regulatory environments, financial services operations, and technology risk management. - Proven track record of leading large-scale cybersecurity programs. - Expertise across the exposure management lifecycle — attack surface management, vulnerability management tools, exposure assessment and prioritization, penetration testing, continuous/automated validation (e.g., breach and attack simulation), threat intelligence, and the use of AI and automation technologies. - Strong grasp of risk-based prioritization, attack-path analysis, and exposure validation to focus remediation on genuinely exploitable
- for any list of duties/requirements/benefits. For About the role we can use