Programme Manager, Crowdsourced Vulnerability Discovery Programmes (CVDP)

The Crowdsourced Vulnerability Discovery Programmes (CVDP) comprises three programmes: the Government Bug Bounty Programme (GBBP), the Vulnerability Rewards Programme (VRP), and the Vulnerability Disclosure Programme (VDP). The Programme Manager will lead the planning, execution, and monitoring of these programmes, working closely with government agencies, security researchers, and the appointed bug bounty vendor to ensure the programmes run successfully.

Key Responsibilities:

• Plan, schedule, and oversee GBBP, VRP, and VDP runs.
• Coordinate with government agencies on programme participation and scoping timelines, including following up to ensure required data and documentation are submitted on time.
• Manage the CVDP vendor relationship, including contract administration, performance monitoring, and issue escalation, covering end-to-end preparation of each GBBP run and onboarding of researchers (recruitment, vetting, test account provisioning).
• Support the triage team in preparing reports, and coordinate with agencies on programme matters if disputes arise.
• Support procurement and tender exercises, including drafting requirement specification sand evaluating vendor proposals.
• Prepare programme reporting, dashboards, and management updates for management and stakeholders.
• Drive stakeholder communications and programme outreach such as Agencies briefings to raise awareness and grow agency participation rates.
• Proactively identify and propose process improvement opportunities across CVDP operations, and lead their implementation - including leveraging vibe coding techniques and GovTech platforms (e.g. Ownself Gather, Opus) to automate workflows, improve reporting, and enhance programme efficiency.

Requirements:

• At least five (5) years of experience managing IT or technology programmes/ projects experience managing a bug bounty, vulnerability disclosure, or related cybersecurity programme is a strong plus.
• Strong project management skills to plan, execute, and monitor programme operations.
• Good verbal and written communication skills in English, with the ability to explain technical findings to non-technical stakeholders.
• Experience managing vendors or contracts, including tracking deliverables and service levels.
• Comfortable working with data to track programme metrics and produce reports for management.
• Demonstrated ability to propose and implement process improvements, including using AI-assisted development (vibe coding) or GovTech-approved platforms to streamline operations.
• Singapore Citizen or Singapore Permanent Resident, as the role involves handling government systems/data requiring security clearance eligibility.

Preferred

• Project Management Professional (PMP), Certified IT Project Manager (CITPM), or equivalent certification.
• Familiarity with vulnerability management, penetration testing, or bug bounty concepts.
• Experience working with or within the public sector.