Senior Enterprise Identity Architect for Zero Trust

STARHUB LTD.

Singapore

On-site

SGD 180,000 - 240,000

Full time

4 days ago

Be an early applicant

Get a reply from this employer

Your resume and cover letter, tailored to exactly what they’re hiring for.

Get past ATS filters

Job summary

STARHUB LTD. is seeking a seasoned Identity & Access Management leader to drive the enterprise IAM programme. You will define canonical identity, govern non-human identities, and champion a Google-first workforce authentication strategy across SuccessFactors and legacy sources.

You will oversee migration, JML automation, and secure AI agent identities while aligning with Singapore requirements and executive governance. This role demands strong vendor management and board-facing communication.

Qualifications

12+ years in identity and access management, security architecture or enterprise platforms with end-to-end IAM programme leadership.
Led a large directory migration (on‑prem AD to cloud IdP) for thousands of identities.
Hands-on depth in identity lifecycle, JML automation, IGA, PAM, SSO/federation, and access certification.
Experience governing non-human identities: service accounts, workload identity, secrets and certificate patterns (AWS IAM a plus).
Knowledge of Zero Trust architecture and AI agent identity controls.
Experience reconciling identities across HR systems or post‑M&A environments.
Experience presenting to C‑level or boards with business cases and funding.
Ability to lead lean teams, manage MSPs/vendors to SLAs and outcomes.
Coaching and developing junior engineers or specialists.
Familiarity with Singapore requirements (CSA, PDPA, IMDA AI governance) preferred.
Certifications (CISSP, CISM, CCSP, IDPro CIDPro, Google Cloud or AWS security) are an advantage.

Responsibilities

Own Identity-Led Enterprise strategy and 18-month roadmap with budget and milestones.
Define canonical identity model and authoritative sources across systems.
Establish Google Workspace/Cloud Identity as the sole workforce authentication and SSO front door.
Retire AD as workforce authority: migrate, federate, retire or manage exceptions.
Govern privileged, non-human and AI-agent identities with accountable human ownership.
Implement CISO-set identity policy; BTS operates it, while the CISO owns policy, risk and exceptions.
Report status, risks and decisions to the CIO, ISLT and ICC; own Identity OKR.
Lead architecture delivery and AD coexistence strategy across applications and endpoints.
Drive identity migration waves with clean-up, deprovisioning and validated testing.
Automate JML from SuccessFactors and contractor/guest workflows with sponsorship and end dates.
Reconcile MyRepublic, JOS and Strateq under the canonical model with clear controls.