AVP/VP, Directory Services Operations Engineer, Technology Group Greater Singapore Area

GIC is one of the world’s largest sovereign wealth funds. With over 2,000 employees across 11 locations around the world, we invest in more than 40 countries globally across asset classes and businesses. Working at GIC gives you exposure to an extraordinary network of the world’s industry leaders. As a leading global long-term investor, we Work at the Point of Impact for Singapore’s financial future, and the communities we invest in worldwide.

Technology GroupWe experiment, design, and lead a 24×7 global business where we support core capabilities in asset management, trading, investment operations, and risk management. We deliver secure, reliable, and integrated solutions, and provide insights on new, and emerging technologies.

What impact will you make in this role?

As our Active Directory and Microsoft Entra ID Operations Engineer, you will operate, secure and continuously improve GIC's hybrid identity platform across on-premises Active Directory and Microsoft Entra ID. The role combines hands-on L3 operations, incident resolution, security hardening, automation, resilience and identity governance. You will support critical identity services, enterprise application integrations and hybrid authentication, while partnering with Cybersecurity, infrastructure and application teams. Critical and maintenance changes may be implemented outside business hours, including weekends.

About the team

Identity and Directory Services is part of GIC's Technology Group. The team runs the Active Directory and Microsoft Entra ID services that provide secure and reliable access to systems and data. We operate a hybrid Microsoft identity environment and work closely with Cybersecurity, infrastructure, end-user computing and application teams to deliver services that are secure by design, resilient and well governed.

What will you do as a AVP/VP, Directory Services Operations Engineer, Technology Group?

Active Directory operations and resilience

Administer AD DS across a multi-domain forest, including users, groups, organisational units, delegation, trusts, sites, replication and FSMO roles.

Build, patch, monitor and capacity-plan domain controllers, and operate AD-integrated DNS and DHCP.

Troubleshoot and manage Group Policy across its lifecycle, from security baselines and deployment through to retirement.

Operate AD Certificate Services and PKI, including certification authority health, templates, certificate issuance and lifecycle management.

Own AD backup and disaster recovery processes, including regular recovery testing and full forest recovery readiness.

Microsoft Entra ID and hybrid identity operations

Resolve complex sign-in, MFA, SSPR, account lockout and Entra joined or hybrid joined device issues using sign-in, audit and diagnostic logs.

Monitor and support Microsoft Entra Connect and Cloud Sync, including password hash sync, pass-through authentication and synchronisation failures.

Diagnose Conditional Access issues, including Intune device compliance dependencies, and support controlled policy changes using What If and report-only mode.

Configure and support enterprise application integrations using SAML, OIDC and SCIM, including SSO, provisioning and application consent.

Manage B2B guest access, cross-tenant access settings, dynamic groups and group-based licensing.

Support identity lifecycle capabilities, including access reviews, entitlement management and lifecycle workflows.

Identity security and compliance

Implement and operate tiered administration, privileged access management, Windows LAPS, Entra role-based access control and Privileged Identity Management.

Support phishing-resistant MFA using passkeys (FIDO2), Windows Hello for Business, Microsoft Authenticator and Temporary Access Pass.

Harden Kerberos and NTLM, and remediate risks identified by tools such as CrowdStrike, PingCastle and Purple Knight.

Investigate Entra ID Protection risky users and sign-ins, and coordinate response to Microsoft Defender for Identity and Defender XDR alerts with Cybersecurity.

Perform access reviews and provide audit evidence in line with internal controls and the MAS Technology Risk Management Guidelines.

Incident, change and service management

Own L3 incidents, problems and requests from diagnosis through resolution, engaging Microsoft Unified Support or engineering teams when required.

Lead root-cause analysis for recurring issues and drive corrective and preventive actions.

Plan and implement identity changes through ITIL-aligned change processes, with appropriate testing, peer review, rollback and stakeholder communication.

Maintain service health dashboards, operational metrics, runbooks, knowledge articles and technical procedures, and coach L1/L2 support teams.

Automation and continuous improvement

Automate administration, health checks and reporting using PowerShell, Microsoft Graph PowerShell SDK and Microsoft Graph API, with version control and peer review.

Use KQL and relevant Microsoft monitoring platforms to analyse identity, authentication and security events.

Identify opportunities to simplify, standardise and improve the security, reliability and supportability of hybrid identity services.

Must have requirements

6-10 years of experience in IT infrastructure or identity operations, with strong hands-on experience supporting both Active Directory and Microsoft Entra ID in a large enterprise environment.

Strong knowledge of AD DS, Group Policy, AD-integrated DNS and DHCP, sites and replication, trusts, FSMO roles and domain controller lifecycle management.

Demonstrated L3 troubleshooting of Microsoft Entra ID authentication, MFA, SSPR and Conditional Access using sign-in and audit logs.

Hands-on hybrid identity experience with Microsoft Entra Connect or Cloud Sync, including password hash sync or pass-through authentication.

Practical experience integrating applications using SAML, OIDC and SCIM.

Experience implementing or operating privileged identity controls, including tiered administration, LAPS, PIM, role-based access control and least privilege.

Experience with AD backup, disaster recovery and forest recovery procedures.

Working knowledge of AD Certificate Services and PKI operations.

PowerShell scripting experience, preferably including Microsoft Graph PowerShell SDK.

Experience working within ITIL-aligned incident, problem and change management processes.

Clear written and verbal communication, including the ability to document technical procedures and explain complex issues to technical and non-technical stakeholders.

Nice to have qualifications

Microsoft Certified: Identity and Access Administrator Associate (SC-300), Microsoft security certification or equivalent.

Experience with Microsoft Entra ID Governance, Intune, Microsoft Defender for Identity, Defender XDR, Microsoft Sentinel or Log Analytics.

Familiarity with AD assessment and security tools such as PingCastle, Purple Knight or CrowdStrike identity protection capabilities.

Experience planning and testing full AD forest recovery.

KQL experience for identity and security log analysis.

Experience in financial services or another regulated industry, including familiarity with MAS Technology Risk Management Guidelines.

Key Competencies and Behaviours

Security mindset: Balances operational needs, user experience and risk, and raises concerns constructively.

Ownership: Takes issues through to root cause and sustainable resolution, with clear stakeholder communication.

Analytical rigour: Uses evidence and structured troubleshooting, including during high-severity incidents.

Composure: Communicates clearly and calmly under pressure and during out-of-hours changes.

Continuous improvement: Automates, simplifies and standardises operations while improving resilience and control.

Collaboration: Works effectively across teams, shares knowledge and builds trust.

Curiosity: Keeps current with the Microsoft identity roadmap and converts new capabilities into practical improvements.

Work at the Point of ImpactWe need to be forward-looking to attract the right people to help us become the Leading Global Long-term Investor. Join our ambitious, agile, and diverse teams - be empowered to push boundaries and pursue innovative ideas, share your views, and be heard. Be anchored on our PRIME Values: Prudence, Respect, Integrity, Merit and Excellence, which guides us in how we make our day-to-day decisions. We strive to inspire. To make an impact.

GIC is a Great Place to Work

At GIC, our offices are vibrant hubs for ideation, professional growth, and interpersonal connection. At the same time, we believe that flexibility allows us to do our best work and be our best selves. Thus, our teams come into the office four days per week to harness the benefits of in-person collaboration, but have the flexibility to choose which days they work from home and adjust this arrangement as situational needs arise. This role will be in our Tampines Office.

GIC is an equal opportunity employer As an employer, we passionately believe every individual brings with them unique diversity of thought and perspectives to meaningfully enrich perspectives of GIC teams to drive competitive performance. An inclusive environment yields exceptional contribution.

Learn more about our Technology Group here: