AVP, Corporate Enterprise Identity Systems

Job Description

Role Mission

Make identity StarHub’s enterprise control plane: one canonical identity, Google Workspace / Cloud Identity as the workforce front door, planned AD retirement, and accountable governance of all identities.

Own the end-to-end identity roadmap across architecture, authoritative sources, migration, lifecycle and operations, enabling Zero Trust, AWS, M&A and safe AI adoption.

Accountabilities

- Own the Identity-Led Enterprise strategy and 18-month roadmap, delivering approved scope, budget and milestones.

- Own the canonical identity model (Global Person ID), authoritative sources and attribute precedence across SuccessFactors and legacy M&A sources.

- Establish Google Workspace / Cloud Identity as the sole workforce authentication and SSO front door.

- Retire AD as a workforce authority: inventory dependencies, then migrate, federate, retire or time-bound exceptions.

- Govern privileged, non-human and AI-agent identities so privileged/autonomous actions remain attributable to an accountable human.

- Implement CISO-set identity policy; BTS operates it, while the CISO owns policy, risk acceptance and exceptions.

- Report status, risks and decisions to the CIO, ISLT and ICC, and own the Identity OKR.

Strategy & Architecture

- Translate the Identity-Led Enterprise position paper into a phased architecture covering authoritative sources, canonical identity, Google front door, access enforcement, workload access and telemetry.

- Define AD-to-Google coexistence, including event authority, JML and exit criteria for every AD dependency.

- Select IGA/PAM tooling that supports the Google-first model without creating a second identity authority.

- Set integration and onboarding standards for applications, AWS, endpoints, integration and AI platforms.

Delivery & Migration

- Lead matrixed architecture, security, engineering, project resources and partners; control scope, sequencing, RAID and budget.

- Deliver migration waves with identity clean-up, role/group rationalisation, orphan-account testing and validated deprovisioning.

- Automate JML from SuccessFactors and approved contractor/guest workflows, including sponsors, end dates and revalidation.

- Reconcile MyRepublic, JOS and Strateq under the canonical model using match logic, confidence thresholds, adjudication and merge/unmerge controls.

Governance & Controls

- Separate standard and privileged personas; enforce named approvals, break-glass controls and quarterly access certification.

- Maintain a non-human identity registry covering owner, purpose, environment, credentials, review and decommission trigger.

- Enforce zero net-new unmanaged shared/generic accounts and reduce existing account debt to a published schedule.

- Govern AI agents as non-human identities with approved purpose, data domains, actions and act-as/on-behalf-of modes, aligned to the IMDA Model AI Governance Framework for Agentic AI.

- Feed GWS, AWS, endpoints and critical applications into the SIEM using common identity identifiers.

- Provide audit evidence for identity controls, including CCoP and internal audit.

Qualifications

Team, Vendors & Stakeholders

- Lead and develop the IAM Specialist across identity engineering, governance and controls.

- Own the IAM managed-service vendor, including scope, SLAs/KPIs, reviews, change and commercial performance.

- Retain StarHub design authority and control ownership; build internal capability and reduce vendor dependency under the IS Best Team insourcing strategy.

- Partner with HR and application/platform owners on data quality, lifecycle, roles, approvals and provisioning.

- Optimise Google/Microsoft licensing as AD retires; track business-case benefits and report realisation to Finance.

Areas of Impact

- Zero Trust enforcement across the corporate estate.

- Single-provider SSO and improved employee/partner sign-in.

- AD retirement and associated Microsoft licence savings.

- Fewer orphaned, shared and ownerless accounts and cleaner audits.

- Safe, attributable AI-agent adoption.

- Faster, lower-cost future M&A integration.

- Move Identity from Legacy to Intelligent on the IS estate map by FY30, and Identity & Access from L2 to L4.

Ideal Track Record

- 12+ years in identity and access management, security architecture or enterprise platforms, including leading at least one enterprise IAM programme end to end.

- Has led at least one large directory migration or consolidation (for example on-premises AD to a cloud IdP such as Google Cloud Identity, Entra ID or Okta) in an organisation of several thousand identities.

- Hands-on depth in identity lifecycle and JML automation, IGA, PAM, SSO / federation (SAML, OIDC, SCIM) and access certification.

- Experience governing non-human identities: service accounts, workload identity, secrets and certificate-based patterns, ideally including AWS IAM.

- Working knowledge of Zero Trust architecture and emerging identity controls for AI agents.

- Experience reconciling identities across multiple HR systems or after mergers and acquisitions.

- Has presented to C-level or board committees and won funding and decisions with clear business cases.

- Delivers through a lean team and influence: managed-service vendors, system integrators and matrixed teams, with a track record of holding vendors to SLAs and outcomes.

- Has coached and developed junior engineers or specialists.

- Familiarity with Singapore requirements (CSA Cybersecurity Code of Practice, PDPA, IMDA AI governance) preferred.

- Relevant certifications (e.g. CISSP, CISM, CCSP, IDPro CIDPro, Google Cloud or AWS security) are an advantage.