CFrFractionalOFind a firm

Singapore · Chief Information Security Officer

Fractional CISO in Singapore

The second most-established fractional role after CFO, and for the same reason: the need is compliance-triggered and finite. An enterprise customer conditions a contract on ISO 27001, a regulator names a required officer, an insurer asks for MFA and offline backup attestations before renewal — and a company of eighty people discovers it needs security judgment it cannot justify hiring full-time.

A foreign-owned SME frequently cannot obtain an Employment Pass for a full-time foreign executive because of COMPASS. Contracted leadership is the only legal route to that expertise.

Find a CISO in Singapore

What they deliver

  • Security programme and a costed 12–18 month roadmap
  • ISO 27001 or SOC 2 readiness, through to managing the external auditor
  • Incident response plan mapped to each regulator’s notification clock, and the tabletop exercises to test it
  • Enterprise customer security questionnaires — often the highest-return work on the whole mandate
  • Third-party and vendor risk: tiering, diligence, contract security schedules
  • Board and regulator reporting, and managing the MSSP or a small internal team

Signals you need one

  • A customer has made ISO 27001 or a security questionnaire a condition of the contract
  • You have had a breach, a ransomware scare, or a near-miss nobody formally closed out
  • Cyber insurance renewal came back loaded, or declined
  • A buyer or investor has commissioned technical due diligence
  • Security has been the CTO’s side job and headcount is now past fifty
  • You have security engineers but nobody senior enough to set the direction
Two markets where this does not work

Saudi Arabia and South Korea both require the named security officer to be an internal, full-time appointment — Saudi under NCA Essential Cybersecurity Controls 1-2-2, which requires cybersecurity roles to be filled by full-time Saudi nationals, and Korea under the Network Act, where the CISO is designated and reported to the Ministry of Science and ICT, with larger companies barred from letting that person hold unrelated duties. In both, a fractional CISO can advise the designated officer but cannot be them. Hong Kong is the opposite case: its critical infrastructure regime expressly allows the security management unit and its supervisor to sit outside Hong Kong, which makes it the most fractional-friendly regime in the region.

The Singapore numbers

Fractional, per monthLight advisory S$600–1,500/month; SME growth mandates S$1,500–4,000; startup and fundraising work S$3,000–8,000; embedded one to two days a week S$5,000–15,000+ (USD 3,900–11,700). A typical retainer buys 15–30 senior hours a month.
Full-time, all-inBase S$180,000–300,000 for a mid-market CFO or COO; all-in with CPF, bonus and insurance, S$210,000–390,000. With recruitment fees the true first-year cost runs S$294,000–501,000 — roughly USD 165,000–305,000.
Employer on-costsCPF 17% employer for citizens and permanent residents under 55 — not payable on Employment Pass holders. Ordinary wage ceiling S$8,000/month and an annual total wage ceiling of S$102,000, capping employer CPF at S$17,340 a year. Skills Development Levy of 0.25% on the first S$4,500, maximum S$11.25 per employee per month, applies to everyone including foreigners.
SeveranceNo statutory severance. Retrenchment benefit is a tripartite norm rather than law — two weeks to one month of salary per year of service, with unionised firms typically at one month. Statutory notice runs to four weeks at five years’ service.
Work permitsWork physically performed in Singapore requires a pass; there is no consultant visa. The practical structures are an offshore consultancy invoicing for services rendered abroad with no withholding, appointment as a non-executive director with fees taxed at 24%, an Employment Pass sponsored by the executive’s own entity — often blocked by COMPASS — or an EntrePass for eligible founders.

The full Singapore picture — tax, regulation and market context →

What governs this in Singapore

Employment Pass qualifying salary and COMPASS

EP salary floor S$5,600 at age 23 rising to S$10,700 at 45+, and higher in financial services; rising again in January 2027. Stage 2 requires 40 COMPASS points, and the local-employment-share criterion is the one that defeats small foreign-owned entities. Exemption from COMPASS at a fixed monthly salary of S$22,500.

Fair Consideration Framework

A fourteen-day MyCareersFuture advertisement is required before most EP applications. Non-compliance leads to debarment from work pass privileges.

Companies Act s.145

At least one director must be ordinarily resident in Singapore, and a company secretary must be appointed within six months. Foreign-owned entities usually buy a nominee resident director — a live governance question when the fractional executive is the only senior person on the ground.

IRAS withholding tax

Non-resident director’s fees 24%; non-resident professionals 15% of gross. Crucially, there is no withholding where the services are performed wholly outside Singapore — the single most important line in a cross-border fractional contract.

Other roles in Singapore

Fractional CFOFractional COOFractional CTOFractional CMOFractional CROFractional CHRO

Find a CISO in Singapore

Sharing your details

We will provide the details you submit — name, job title, company, email and telephone — to one executive search or advisory firm in your market, so that it may contact you about its services. We receive a fee from that firm for doing so. We cannot do this without your consent.

You can withdraw this consent at any time, free of charge, by emailing hello@chieffractional.com. We never collect or hold details of individual executives or candidates. See privacy and data and how we are paid.

We reply within one working day.