Feature Articles
#WorkinginCSA: Ensuring Cybersecurity Compliance and Collaboration Across Critical Systems
29 July 2026
Amos is an Assistant Director in CSA, and leads the Home Team cluster in Cybersecurity Programme Centre (CSPC) that provides cybersecurity consultancy to agencies within the Home Team family, to ensure the resilience and cybersecurity of their systems.
1. Tell us more about your team’s work and your role as an Assistant Director in CSPC.
I lead the Home Team cluster in Cybersecurity Programme Centre (CSPC), where our team provides cybersecurity consultancy to agencies within the Home Team family. We focus on identifying and mitigating risks early, ensuring systems are well-architected, and holding security testing to a rigorous standard. Given the operational nature of Ministry of Home Affairs (MHA), the Home Team family runs a wide range of systems. We work to stay deeply familiar with how these systems function and interconnect, to give advice that's genuinely useful to their mission.
I'm also part of the team that works on IM8 policies governing our critical systems. This involves keeping policies current ensuring systems are resilient without adding compliance burden that gets in the way of the teams we support.
2. What inspired you to pursue a career in this field?
Since young, I've always been drawn to technology. I started programming on my own out of curiosity, which eventually led me to pursue a degree in computer engineering. My first job was as a software engineer, and from there I moved into IT project management.
The moment that really shifted my focus toward cybersecurity was a bit embarrassing. A mechanism I used to protect a hobby website I built got easily bypassed almost effortlessly. It was a wake-up call. I realised how little I actually knew about securing the things I built, and that sparked a genuine curiosity about that side of technology.
By the time CSA was formed in 2015, I had already been picking up bits of cybersecurity knowledge through my project management work, so I decided to make the jump and apply. I got the role, and I've been at CSA for ten years. Nonetheless, the field keeps evolving fast enough that there's always something new to learn, which keeps things interesting.
3. What are some projects you’ve worked on in CSA that you found particularly interesting?
One of my most memorable experiences was being called up by my Director to join colleagues from our incident response team at SingHealth. I was a sector officer in our Critical Information Infrastructure (CII) division, covering the Healthcare sector. That was the beginning of what became known as the SingHealth Cyber Attack in 2018. It was intense because the scale and sensitivity of the breach meant every decision carried real weight, and we had to move quickly while still being methodical. It was one of the defining moments for CSA. While I wasn’t an incident responder myself, being on the ground with my colleagues shaped how I think about incident response to this day.
Today's challenges are sharper. I work across an extraordinarily diverse range of systems, and providing guidance to the Home Team means staying ahead of fast-moving fields like AI and quantum computing, not just keeping up with them.— Amos Lau
While core cybersecurity principles still apply, we can’t take a one-size-fits-all approach. Each system has its own quirks, and figuring out the right fit is what keeps the work engaging.
4. Tell us something about your job that not many people know about.
When I tell friends and family that I work in cybersecurity, they always assume I spend my days writing code or actively defending against cyber-attacks. But my job is actually more about making sure systems are designed with security in mind from the start, so that risks are identified and addressed early rather than patched up after the fact. It's less about fighting off attacks, and more about ensuring systems are resilient enough that they're not so easily compromised in the first place.
5. How do you unwind from work?
Outside of work, most of my time is spent with family. My kids are aged 4 and 2, so a big chunk of my free time goes towards looking after them together with my wife, which is exhausting but rewarding in its own way.
Besides that, I’ve recently taken up an interest in vibe coding. Some people frown on it, but I think AI has genuinely helped make writing code more efficient. I enjoy hacking together simple programs or websites that solve everyday problems. That said, my background means I don’t code blindly with AI; I still understand what's happening under the hood, and I treat AI as a tool that does the heavy lifting rather than a replacement for thinking.
This hobby has also made me much more aware of both the usefulness and the risks of AI, which feeds directly back into my work.