Network Security Engineer (L3)

NTT America, Inc.; Cyberjaya; On-site; MYR 150,000 - 260,000; Full time

Job summary

NTT DATA in Cyberjaya is seeking an experienced security architect to own enterprise security across identity, cloud, PKI, and Zero Trust. You will design, govern, and enforce security controls while mentoring junior staff and guiding incident response at the enterprise level.

Responsibilities include leading Entra ID and federation strategy, securing Azure Landing Zone, ExpressRoute, and Private Link data flows, as well as defining 365 security standards.

Qualifications

• Experience designing and governing enterprise security architecture.
• Experience with Microsoft Entra ID, Azure AD and federation.
• Proven ability to implement Zero Trust and PKI strategies.
• Experience with hybrid Azure connectivity and network security.
• Knowledge of security governance and compliance frameworks.

Responsibilities

• Design and govern enterprise identity security architecture.
• Lead Entra ID and federation security strategy.
• Architect and enforce Zero Trust policies.
• Secure Azure Landing Zone and hybrid connectivity.
• Govern ExpressRoute and Private Link data flows.
• Review and approve Conditional Access framework.
• Lead PKI governance and certificate lifecycle strategy.
• Define Microsoft 365 security architecture standards.
• Oversee email security, encryption, and RMS controls.
• Lead advanced threat investigations and root cause analysis.
• Coordinate security incident response at enterprise level.
• Ensure compliance with IT Security Governance Framework.
• Define hardening baselines for identity and cloud systems.
• Provide executive-level security reporting.
• Drive security improvement roadmap initiatives.
• Support audit reviews and compliance assessments.
• Mentor L1 and L2 security team members.
• Validate new workload onboarding against Zero Trust standards.
• Conduct periodic security posture assessments.
• Ensure alignment with ISMS and governance policies.

Skills

Active Directory

Entra ID

Azure AD

SAML

OAuth 2.0 / OIDC

Zero Trust

ExpressRoute

Azure Landing Zone

PKI

PAM (CyberArk)

Microsoft 365 Security

Security governance

Incident response

Tools

Azure Landing Zone

ExpressRoute

Azure Firewall

Private Link

PAM (CyberArk)

Conditional Access

Exchange Online Security

RMS controls

Job description

Make an impact with NTT DATA

Join a company that is pushing the boundaries of what is possible. We are renowned for our technical excellence and leading innovations, and for making a difference to our clients and society. Our workplace embraces diversity and inclusion – it’s a place where you can grow, belong and thrive.

Position Overview

Owns enterprise security engineering across identity, cloud, messaging, PKI, and Zero Trust architecture. Responsible for security design, governance enforcement, advanced incident handling, and strategic hardening initiatives.

Key Responsibilities

• Design and govern enterprise identity security architecture

• Lead Entra ID and federation security strategy

• Architect and enforce Zero Trust policies

• Secure Azure Landing Zone and hybrid connectivity

• Govern ExpressRoute and Private Link data flows

• Review and approve Conditional Access framework

• Lead PKI governance and certificate lifecycle strategy

• Define Microsoft 365 security architecture standards

• Oversee email security, encryption, and RMS controls

• Lead advanced threat investigations and root cause analysis

• Coordinate security incident response at enterprise level

• Ensure compliance with IT Security Governance Framework

• Define hardening baselines for identity and cloud systems

• Manage CyberArk EPM & PAM and custom connector

• Provide executive-level security reporting

• Drive security improvement roadmap initiatives

• Support audit reviews and compliance assessments

• Mentor L1 and L2 security team members

• Validate new workload onboarding against Zero Trust standards

• Conduct periodic security posture assessments

• Ensure alignment with ISMS and governance policies

Requirements

• Active Directory (Multi-Forest), ADFS, Microsoft Entra ID, Azure AD B2C

• Microsoft Identity Manager, Azure AD Connect

• LDAP, SAML, OAuth, OIDC, WS-Fed

• Azure Landing Zone, Hub-and-Spoke Network Model

• ExpressRoute, Azure Firewall, Private Link & Private Endpoints

• Conditional Access Enforcement & Zero Trust Architecture

• Microsoft 5 >NA:.... p>Microsoft 365 Security Architecture & Exchange Online Security