IT Infra Engineer (Identity and Security)

Job Title: Senior / IT Infra Engineer (Identity and Security) Role Overview We are seeking highly skilled and innovative engineer to join our transformative SSOE Programme that manages more than 350 schools across Singapore. This is an exceptional opportunity to shape the future of educational technology infrastructure and enhance the learning experience of more than 450,000 students and 35,000 education professionals. As a Senior / IT Infra Engineer focusing on Identity and Security, you will be the primary engineer for our Zero Trust ecosystem. You will lead the end-to-end design and implementation of both a secure endpoint environment; centre heavily on Data Loss Prevention (DLP), Endpoint Protection Platforms (EPP), and Endpoint Detection and Response (EDR); and identity-driven access governance utilizing on-premises Active Directory (AD) and cloud-native Entra. Your mission is to ensure that every user, device, and application within the Microsoft 365 cloud ecosystem is verified, seamlessly managed throughout the identity lifecycle, and continuously monitored against evolving threats. Key Responsibilities Identity & Access Governance Design and architect Entra ID (Azure AD) solutions, focusing on Conditional Access policies, Privileged Identity Management (PIM), and Identity Protection to enforce least-privileged access. Manage complex Identity Lifecycle processes, ensuring seamless and secure integration between on-premises Active Directory and cloud-native identity providers. Implement and maintain Passwordless authentication and Multi-Factor Authentication (MFA) strategies to eliminate credential-based vulnerabilities. Security Engineering & Threat Protection Work with security team to engineer and operate the Microsoft Defender for Endpoint and Defender for Office 365 suites (EPP/EDR) to proactively hunt for threats and remediate vulnerabilities across the fleet. Deploy and manage Microsoft Purview for information protection, Data Loss Prevention (DLP), and eDiscovery, ensuring sensitive corporate data remains governed and compliant. Develop automated response playbooks using PowerShell and Microsoft Graph API to neutralize security incidents in real-time. Identity & Access Governance Design and architect Entra ID (Azure AD) solutions, focusing on Conditional Access policies, Privileged Identity Management (PIM), and Identity Protection to enforce least-privileged access. Implement and maintain Passwordless authentication and Multi-Factor Authentication (MFA) strategies to eliminate credential-based vulnerabilities. Lead the identity and access design for enterprise-wide rollouts, ensuring robust authentication mechanisms are baked into every deployment. Act as the primary technical liaison for Cybersecurity Audits , providing data-driven evidence of compliance regarding identity lifecycles and access control. Mentor the team on security best practices, conducting knowledge-sharing sessions on the latest Entra features and identity threat landscapes. Automation & Observability Automation: Engineer for scalability by building reusable automation and utilizing PowerShell scripting and related tools like PowerBI, Dynatrace and Axonius to monitor service health and reporting to derive insights. Scripting & API: Use PowerShell , Bash , and Python to automate repetitive tasks and interact with the Microsoft Graph API for custom reporting. Fleet Analytics: Utilize KQL and Endpoint Analytics to monitor device health, battery wear, and application performance across the entire estate. Self-Service: Develop and maintain "Self-Service" portals for both staff and students to empower users and reduce helpdesk ticket volume. General Responsibilities Engage stakeholders to translate business requirement into design and services to meet the intended availability, capacity, resiliency, security and continuity requirements. Forecast budget needed to support the project initiatives and maintenance contracts. Ensure MOE’s related Technic