IAM Specialist: Secure Access & Secrets Architect

TNG Digital

Kuala Lumpur

On-site

MYR 120,000 - 180,000

Full time

48 hours ago

Be an early applicant

Application generator

A complete application in a minute — tailored resume and cover letter, ready to send.

Get past ATS filters

Benefits offered by this job

Medical coverage

Lifestyle allowance via TNG eWallet

Family and caregiving leave

Mobile and broadband reimbursement

Discounts and wellness perks

Job summary

TNG Digital is seeking an experienced IAM security professional to manage privileged and non-human identities across our cloud environments, including Alibaba Cloud RAM, STS, RRSA, and OIDC federation. You will design secure access controls, oversee provisioning, and automate credential rotation to support secure authentication for CI/CD pipelines and Kubernetes workloads.

The role requires 3–5 years in IAM or information security, experience with cloud security across Alicloud, Azure, and AWS,

Qualifications

Bachelor’s degree in computer science, information technology, or a related field.
3–5 years of experience in IAM or information security.
Experience with IAM technologies, such as identity and access governance, access control systems, and identity federation.
Experience in IAM solution implementation (project management, working level, hands-on implementation)
Strong experience designing and governing access controls, SSO, user provisioning/deprovisioning, role-based access, user access matrices and periodic access reviews across enterprise systems.
Proven ability to manage privileged accounts, service accounts, application identities, API tokens, certificates and other non-human identities throughout their lifecycle.
Hands-on expertise in Alibaba Cloud RAM, STS, RRSA and OIDC federation, as well as Microsoft Entra ID App Registrations, Service Principals, Managed Identities and workload identity federation.
Experience managing cryptographic keys and secrets using KMS and Secrets Manager, including least-privilege access, separation of duties, secure storage, rotation, expiration, monitoring and revocation.
Ability to automate identity and credential processes, monitor suspicious access activities, support incident investigations, and demonstrate compliance with security policies, audits and regulatory requirements.
Strong knowledge of security frameworks and regulations, such as BNM RMiT, PCI DSS etc.
Excellent communication and interpersonal skills, with the ability to interact with stakeholders at all levels of the organization.
Relevant industry certifications, such as CISSP or CISM, are preferred.

Responsibilities

Review access control for existing systems and propose improvements.
Manage privileged and non-human identities (service accounts, RAM roles, API tokens, certificates).
Consolidate and streamline access control (SSO) including onboarding/offboarding.
Oversee provisioning/deprovisioning of user accounts and monitor access rights.
Design and implement Alibaba Cloud RAM Roles, RAM Policies, STS AssumeRole, RRSA and OIDC federation.
Manage Alibaba Cloud KMS and Secrets Manager (keys, secrets, rotation, lifecycle).
Define separation between KMS administration, key usage, secret management.
Control and review permissions (Encrypt, Decrypt, GetSecretValue, etc.).
Automate storage and rotation of AK/SK, API tokens, credentials using secrets-management solutions.
Assess requests for long-lived credentials and recommend RAM Roles, STS, OIDC, or KMS Secrets Manager.
Manage Microsoft Entra ID App Registrations, Enterprise Applications, Service Principals, Managed Identities, client secrets, certificates, API permissions, workload identity federation.
Support secure authentication for applications, CI/CD pipelines, Kubernetes/ACK workloads, automation, and cloud services.
Identify and remediate unused or improper credentials and secrets.
Establish credential and cryptographic key rotation standards.
Monitor privileged identities, KMS activities, secret retrieval and credential usage for suspicious activities.
Support periodic User Access Reviews and other access reviews.
Develop automation for identity provisioning, credential rotation and access reviews.
Support audits and regulatory requirements related to identity and credentials.
Manage user access with proper user matrices and monitor policy compliance.
Assist in risk assessments and audits.
Investigate incidents and recommend corrective actions.
Educate users on IAM policies and procedures.
Stay up to date on evolving threats, technologies, and solutions.
Collaborate with other departments to ensure secure access.
Maintain up-to-date knowledge of IAM technologies, trends, and threats, making recommendations to improve security posture.