#WorkinginCSA: On the Frontlines of Operation Cyber Guardian

1. Tell us more about your team’s work and your role as an Assistant Director.

With my team from National Cyber Incident Response Centre

As an Assistant Director of National Cyber Incident Response Centre (NCIRC), my team’s core responsibilities are to investigate cybersecurity incidents affecting our Critical Information Infrastructure (CII) systems and to contain the cyber threat, preventing it from spreading to other systems. Given the dynamism of the cyber domain, there is no typical day at the office. In the absence of significant incidents, we channel our efforts into projects or sharpening our investigative expertise.

As an incident response team lead, I see my primary role as fostering cohesion and collaboration, to ensure that when the need arises, we can operate seamlessly as a unified unit toward a common objective.

2. What inspired you to become interested in cybersecurity/ pursue a career in this field?

Unlike many of my colleagues, I do not have a traditional engineering or computer science degree. However, a personal interest in programming sparked my curiosity about cybersecurity and how it shapes our digital lives. It was thus fortuitous that the Cyber Security Agency of Singapore was founded less than two years before I graduated.

While the phrase “cybersecurity is a team sport” is often considered a cliché, it holds true. I have rarely seen another technical domain where global experts are so willing to share knowledge online. This collaborative culture, combined with industry-recognised certifications, provided a clear pathway for me to build and validate my technical expertise despite a non-traditional background.  

I was also fortunate to have crossed paths with and worked alongside colleagues who were ever willing to guide their juniors (as I was then) and had several supervisors whom I can look up to as mentors. All this constant development and learning culminated in my involvement in Ops Cyber Guardian, alongside various other notable cybersecurity operations in CSA.

3. What are some projects you’ve worked on in CSA that you found particularly interesting and/or challenging? What made them interesting, and how did you navigate the challenges?  

Engagement event for Operation Cyber Guardian

I served as an Incident Response Team Lead for the largest cyber operations ever undertaken by CSA, i.e. Operation Cyber Guardian. It was an eye-opening experience that gave me first-hand insight into the complexities of telco networks and how sophisticated the Advanced Persistent Threat actors can be. It is the type of operation that professionals in the sector would want to be part of, as it is both a personal learning experience and also contributes to a larger national effort to ensure that essential services are not disrupted.

I must also emphasise that success during this challenging period was entirely due to the cooperation (and at times sacrifices) of members of my incident response team, to whom I am grateful and privileged to work with.

4. Tell us something about your job that not many people know about.

A common misconception is that cybersecurity is solely about technical analysis, i.e. staring at computer screens and hunting for malicious code or malware. In reality, stakeholder management, which involves coordinating responses and providing timely updates are just as crucial.

A classic example is the intense pressure to provide stakeholders with continuously, real-time updates during an active incident. Yet, incident response requires thorough investigation which takes time. My work requires managing such expectations and ensuring that my team is able to deliver timely, factual, and defensible reports/updates under pressure.

5. Outside of work, do you have any hobbies and interests? How do you unwind from work?

I unwind by taking quiet moments away from the bustle of work. As I am fortunate enough to live relatively close to CSA’s new office in PDD, I regularly cycle to and fro from work to enjoy the serenity of the surrounding area.