AVP, Corporate Enterprise Identity Systems

StarHub; Singapore; On-site; SGD 180,000 - 240,000; Full time

Job summary

StarHub is seeking an experienced Identity & Access Management leader to own the end-to-end roadmap for identity across Google Workspace, Cloud Identity and legacy AD. You will drive migration, governance and JML automation, enabling Zero Trust and safe AI adoption across the enterprise.

You will oversee architecture, data sources, and lifecycle management, collaborating with security, IT operations and HR to retire AD and establish a canonical identity model. Singapore-based role.

Qualifications

• 12+ years in identity and access management, security architecture or enterprise platforms, leadership experience.
• Experience leading large directory migrations and consolidations in complex orgs.
• Hands-on knowledge of IAM lifecycle, IGA, PAM, SSO/federation and access certification.
• Familiarity with Zero Trust concepts and AI governance in identity contexts.

Responsibilities

• Own the Identity-Led Enterprise strategy and 18-month roadmap with scope, budget and milestones.
• Define canonical identity model and authoritative sources across systems (SuccessFactors, legacy sources).
• Establish Google Workspace/Cloud Identity as the workforce front door and retire AD as authority.
• Govern privileged and non-human identities; enforce policy and risk management aligned to CISO.
• Lead migration waves, JML automation, and deprovisioning validation across apps and HR systems.
• Coordinate with CIO/ISLT/ICC on status, risks, and Identity OKR; oversee vendor relationships.

Skills

IAM leadership

Security architecture

Identity lifecycle

JML automation

Zero Trust

Stakeholder mgmt

Governance

Vendor management

Tools

Google Cloud Identity

AD/Directory Services

SIEM

SAML/OIDC

Job description

Role Mission

Make identity StarHub’s enterprise control plane: one canonical identity, Google Workspace / Cloud Identity as the workforce front door, planned AD retirement, and accountable governance of all identities.

Job Description

Role Mission

Make identity StarHub’s enterprise control plane: one canonical identity, Google Workspace / Cloud Identity as the workforce front door, planned AD retirement, and accountable governance of all identities.

Own the end-to-end identity roadmap across architecture, authoritative sources, migration, lifecycle and operations, enabling Zero Trust, AWS, M&A and safe AI adoption.

Accountabilities

• Own the Identity-Led Enterprise strategy and 18-month roadmap, delivering approved scope, budget and milestones.


• Own the canonical identity model (Global Person ID), authoritative sources and attribute precedence across SuccessFactors and legacy M&A sources.


• Establish Google Workspace / Cloud Identity as the sole workforce authentication and SSO front door.


• Retire AD as a workforce authority: inventory dependencies, then migrate, federate, retire or time-bound exceptions.


• Govern privileged, non-human and AI-agent identities so privileged/autonomous actions remain attributable to an accountable human.


• Implement CISO-set identity policy; BTS operates it, while the CISO owns policy, risk acceptance and exceptions.


• Report status, risks and decisions to the CIO, ISLT and ICC, and own the Identity OKR.

Strategy & Architecture

• Translate the Identity-Led Enterprise position paper into a phased architecture covering authoritative sources, canonical identity, Google front door, access enforcement, workload access and telemetry.


• Define AD-to-Google coexistence, including event authority, JML and exit criteria for every AD dependency.


• Select IGA/PAM tooling that supports the Google-first model without creating a second identity authority.


• Set integration and onboarding standards for applications, AWS, endpoints, integration and AI platforms.

Delivery & Migration

• Lead matrixed architecture, security, engineering, project resources and partners; control scope, sequencing, RAID and budget.


• Deliver migration waves with identity clean-up, role/group rationalisation, orphan-account testing and validated deprovisioning.


• Automate JML from SuccessFactors and approved contractor/guest workflows, including sponsors, end dates and revalidation.


• Reconcile MyRepublic, JOS and Strateq under the canonical model using match logic, confidence thresholds, adjudication and merge/unmerge controls.

Governance & Controls

• Separate standard and privileged personas; enforce named approvals, break-glass controls and quarterly access certification.


• Maintain a non-human identity registry covering owner, purpose, environment, credentials, review and decommission trigger.


• Enforce zero net-new unmanaged shared/generic accounts and reduce existing account debt to a published schedule.


• Govern AI agents as non-human identities with approved purpose, data domains, actions and act-as/on-behalf-of modes, aligned to the IMDA Model AI Governance Framework for Agentic AI.


• Feed GWS, AWS, endpoints and critical applications into the SIEM using common identity identifiers.


• Provide audit evidence for identity controls, including CCoP and internal audit.

Team, Vendors & Stakeholders

• Lead and develop the IAM Specialist across identity engineering, governance and controls.


• Own the IAM managed-service vendor, including scope, SLAs/KPIs, reviews, change and commercial performance.


• Retain StarHub design authority and control ownership; build internal capability and reduce vendor dependency under the IS Best Team insourcing strategy.


• Partner with HR and application/platform owners on data quality, lifecycle, roles, approvals and provisioning.


• Optimise Google/Microsoft licensing as AD retires; track business-case benefits and report realisation to Finance.

Areas of Impact

• Zero Trust enforcement across the corporate estate.


• Single-provider SSO and improved employee/partner sign-in.


• AD retirement and associated Microsoft licence savings.


• Fewer orphaned, shared and ownerless accounts and cleaner audits.


• Safe, attributable AI-agent adoption.


• Faster, lower-cost future M&A integration.


• Move Identity from Legacy to Intelligent on the IS estate map by FY30, and Identity & Access from L2 to L4.

Ideal Track Record

• 12+ years in identity and access management, security architecture or enterprise platforms, including leading at least one enterprise IAM programme end to end.


• Has led at least one large directory migration or consolidation (for example on-premises AD to a cloud IdP such as Google Cloud Identity, Entra ID or Okta) in an organisation of several thousand identities.


• Hands-on depth in identity lifecycle and JML automation, IGA, PAM, SSO / federation (SAML, OIDC, SCIM) and access certification.


• Experience governing non-human identities: service accounts, workload identity, secrets and certificate-based patterns, ideally including AWS IAM.


• Working knowledge of Zero Trust architecture and emerging identity controls for AI agents.


• Experience reconciling identities across multiple HR systems or after mergers and acquisitions.


• Has presented to C-level or board committees and won funding and decisions with clear business cases.


• Delivers through a lean team and influence: managed-service vendors, system integrators and matrixed teams, with a track record of holding vendors to SLAs and outcomes.


• Has coached and developed junior engineers or specialists.


• Familiarity with Singapore requirements (CSA Cybersecurity Code of Practice, PDPA, IMDA AI governance) preferred.


• Relevant certifications (e.g. CISSP, CISM, CCSP, IDPro CIDPro, Google Cloud or AWS security) are an advantage.