AVPVP, Entra ID & Identity Security Engineer, Technology Group

Location:Singapore

Job Function:Technology Group

Job Type:Permanent

Req ID:17256

GIC is one of the worlds largest sovereign wealth funds. With over 2000 employees across 11 locations around the world we invest in more than 40 countries globally across asset classes and businesses. Working at GIC gives you exposure to an extraordinary network of the worlds industry leaders. As a leading global long-term investor we Work at the Point of Impact for Singapores financial future and the communities we invest in worldwide.

Technology Group
The Technology Group (TG) is a key enabler to keep our business moving forward and is constantly exploiting state-of-the-art information technologies to enhance GICs ability to be the leading global long-term investment firm. We aim to provide users with empowering and transformational capabilities and to create an inclusive innovative and integrated work environment.

Infrastructure & Cybersecurity Resilience (ICR)
We design build and secure the technology foundations that power GICs global investment operations. We aim to deliver resilient scalable and secure infrastructure that empowers our people and businesses to perform securely efficiently and effectively.

What impact can you make in this role

We are seeking an experienced Entra ID & Identity Security Engineer to lead the security hardening and automation of our cloud-first identity platform. This role is centred on Entra ID (Azure AD) Conditional Access Identity Protection Privileged Identity Management (PIM) app and workload identities and tenant-wide security posture with on-premises Active Directory addressed in the context of a secure hybrid identity estate.

What will you do as an Entra ID & Identity Security Engineer

Entra ID & Cloud Identity Security (primary focus)

• Design secure and operate the Entra ID tenant as the core of the enterprise identity platform ensuring resilience integrity and threat resistance.

• Engineer and continuously harden Conditional Access policies Identity Protection and risk-based controls aligned to Zero Trust principles.

• Implement and govern Privileged Identity Management (PIM) administrative units and least-privilege delegation across the tenant.

• Secure app registrations enterprise applications service principals managed identities and workload identities including consent governance and secret/credential hygiene.

• Conduct threat modelling and exposure assessments for Entra ID to identify and mitigate identity attack paths (e.g. token theft/replay consent phishing illicit grants privilege escalation).

• Design Entra ID tenant recovery and identity incident-response automation to improve recovery time objectives (RTO) and operational readiness.

Hybrid & Active Directory (secondary / hybrid context)

• Secure the ADEntra ID hybrid surface synchronization federation and Tier 0 protection to prevent lateral movement between on-prem and cloud.

• Apply baseline hardening to AD forests domains trusts OU delegation and GPOs where they impact the hybrid identity security posture.

• Support AD Forest recovery readiness as part of the broader hybrid resilience plan.

Agentic AI & LLM-Driven Engineering

• Apply Agentic AI and LLMs as core engineering tools to accelerate identity security engineering code generation configuration analysis remediation drafting and investigation support.

• Design orchestrate and operate AI/AIOps agents (single and multi-agent) for identity hygiene posture analysis anomaly triage and automated remediation workflows.

• Build agent-ready interfaces and context so AI agents can reliably and safely act against identity systems with appropriate guardrails evaluation and human-in-the-loop controls.

• Champion responsible secure use of LLMs (prompt/secret hygiene data handling validation of AI output) within the identity engineering team.

DevOps & Platform / API Engineering

• Develop in a DevOps model using Git and GitHub with automated CI/CD via GitHub Actions for testing validation and safe deployment of identity controls and automation.

• Design and engineer API-based frameworks that provide an abstraction-as-a-service layer over identity capabilities (e.g. Microsoft Graph) giving consumers and agents clean governed reusable interfaces.

• Build automation frameworks (PowerShell Python Graph API) to audit and report configurations enforce baseline hardening and automate remediation monitoring and hygiene tasks.

• Apply infrastructure-as-code / policy-as-code practices to make identity configuration versioned reviewable and auditable.

Documentation-as-Code & Machine-Readable Repository

• Model and maintain a repository in which code and documentation-as-code form a single conceptual model versioned reviewed and treated as a source of truth.

• Ensure the repository is machine-readable so that AI agents (not only humans) can parse reason over and act on the documented model and controls.

• Maintain baselines runbooks recovery guides and assessment reports as living code-managed artefacts rather than static documents.

Collaboration Detection & Governance

• • Collaborate with Red Team Penetration Testing and SOC teams to identify vulnerabilities validate attack paths and remediate exposures.

  • Simulate and analyse identity-based attack scenarios (e.g. token replay consent phishing illicit consent grants PIM abuse; and AD-side techniques such as Kerberoasting Pass-the-Hash DCSync where hybrid-relevant).

  • Integrate detection and response capabilities with SIEM/SOC tooling (e.g. Microsoft Sentinel Splunk QRadar) and Microsoft Defender for Identity.

  • Collaborate with IAM teams to integrate identity workflows (provisioning deprovisioning access reviews) into enterprise identity lifecycle and governance processes.

What qualifications or skills should you possess in this role

• Deep hands-on Entra ID expertise Conditional Access Identity Protection PIM app/workload identities administrative units and tenant hardening.
• Practical experience applying Agentic AI / LLMs and AIOps agents to engineering work including orchestrating agent workflows with appropriate guardrails.
• Strong DevOps engineering skills: Git GitHub GitHub Actions / CI/CD and version-controlled automated delivery.
• Demonstrated ability to design and build API-based abstraction/service layers (e.g. over Microsoft Graph) for reuse by humans and agents.
• Strong scripting and automation skills (PowerShell and/or Python) and Microsoft Graph API proficiency for auditing reporting and enforcement.
• Experience treating documentation-as-code and maintaining machine-readable repositories as part of an engineering workflow.
• Working knowledge of hybrid identity and Active Directory (sync federation Tier 0 trusts GPO) sufficient to secure the hybrid surface.
• Familiarity with identity security tooling such as Microsoft Defender for Identity BloodHound PingCastle and PurpleKnight.
• Strong understanding of Zero Trust and the Enterprise Access Model (EAM) as applied to cloud-first and hybrid identity.
• Knowledge of Privileged Access Management (PAM) and SIEM integration for identity threat detection.
• The following certifications are preferred: Microsoft Certified: Identity and Access Administrator Associate (SC-300)Cybersecurity Architect Expert (SC-100)Windows Server Hybrid Administrator or equivalent advanced security certification relevant DevOps / cloud certifications (e.g. GitHub Actions Azure DevOps AZ-400) are advantageous.

Work at the Point of Impact
We need to be forward-looking to attract the right people to help us become the Leading Global Long-term Investor. Join our ambitious agile and diverse teams - be empowered to push boundaries and pursue innovative ideas share your views and be anchored on our PRIME Values: Prudence Respect Integrity Merit and Excellence which guides us in how we make our day-to-day decisions. We strive to inspire. To make an impact.

Flexibility at GIC
At GIC our offices are vibrant hubs for ideation professional growth and interpersonal connection. At the same time we believe that flexibility allows us to do our best work and be our best selves. Thus our teams come into the office four days per week to harness the benefits of in-person collaboration but have the flexibility to choose which days they work from home and adjust this arrangement as situational needs arise.

GIC is an equal opportunity employer
As an employer we passionately believe every individual brings with them unique diversity of thought and perspectives to meaningfully enrich perspectives of GIC teams to drive competitive performance. An inclusive environment yields exceptional contribution.

Learn more about our Technology Group here:
Experience:

Exec