VP, IAM Platform Engineer (Secrets Management & Authorization), Technology Group

GIC is one of the world’s largest sovereign wealth funds. With over 2,000 employees across 11 locations around the world, we invest in more than 40 countries globally across asset classes and businesses. Working at GIC gives you exposure to an extraordinary network of the world’s industry leaders. As a leading global long-term investor, we Work at the Point of Impact for Singapore’s financial future, and the communities we invest in worldwide.

Technology Group

We experiment, design, and lead a 24×7 global business where we support core capabilities in asset management, trading, investment operations, and risk management. We deliver secure, reliable, and integrated solutions, and provide insights on new, and emerging technologies.

Infrastructure & Cybersecurity Resilience (ICR)

We design, build, and secure the technology foundations that power GIC’s global investment operations. We aim to deliver resilient, scalable, and secure infrastructure that empowers our people and businesses to perform securely, efficiently, and effectively.

What impact can you make in this role?

You’ll be empowered to be at the top of your game by providing strategic partnership, and innovative technology solutions that support GIC’s vision of being a tech-driven, global, long-term investment firm. In this hands-on role within IAM Engineering, you will lead the new build and organisation-wide rollout of two IAM platforms: a HashiCorp Vault platform for secrets management, followed by a central Authorization Engine that decides access based on policy (PBAC).

What will you do as a VP, IAM Platform Engineer (Secrets Management & Authorization)?

• Lead GIC’s new HashiCorp Vault implementation end to end, from reference architecture and high-availability/disaster-recovery design through production readiness and phased rollout.
• Design and operate Vault’s secrets engines, auth methods and policies to replace hard-coded, long-lived credentials with dynamic, short-lived ones. This includes migrating existing secrets and fixing exposed secrets found by Vault Radar.
• Help design and build the Authorization Engine, a central service that applications call for access decisions, with policies written, tested and released as code. Grow into its technical ownership.
• Build Kubernetes and AWS integrations and standard patterns for teams to follow. Drive adoption through self-service onboarding, reusable modules and adoption metrics.
• Manage both platforms as code through Terraform, Ansible and GitHub CI/CD, and own their reliability as business-critical (Tier-0) security services. Use AI coding tools in engineering work, with human review and guardrails.
• Direct implementation vendors and service partners, hold them to GIC’s standards, and ensure knowledge transfer so GIC can run both platforms independently.

What qualifications or skills should you possess in this role?

• Bachelor’s Degree in Computer Science, Computer Engineering, Information Technology or equivalent.
• At least 10 years of relevant experience, preferably in financial services or asset management industries, with minimum 5 years in IAM or secrets management engineering.
• Deep, hands-on HashiCorp Vault expertise in production, ideally including at least one new implementation taken from design to organisation-wide rollout. Specifically:
  • Secrets engines (KV v2, database, PKI, Transit, SSH, AWS) and auth methods (AppRole, JWT/OIDC, Kubernetes, AWS IAM)
  • High-availability/disaster-recovery design, hardening, and Vault Enterprise features (Sentinel, namespaces, replication)
  • Kubernetes integration (Vault Agent injector, CSI Secrets Store driver)
• Foundational understanding of policy-based authorization: how central decision and enforcement points work together (PDP/PEP), policy-as-code, and attribute-, role- and relationship-based access models. Exposure to a platform such as PlainID, PingAuthorize, OPA/Styra or Cerbos, and a strong appetite to deepen this on the job.
• Strong in Terraform (including the Vault provider), Ansible, Git and GitHub Actions, and Kubernetes and AWS at scale (IAM, EKS, IRSA/Pod Identity, KMS).
• Good understanding of OAuth2, OIDC, JWT, PKI and cryptography basics.
• Scripting and coding skills in Python, Go or Bash, with good understanding of REST APIs.
• Track record of driving adoption of a platform across many teams, and of leading vendors through complex implementations while keeping ownership in-house.
• Working knowledge of AI coding agents and LLM tools. Experience with Azure/GCP secrets services or CyberArk would be advantageous.
• HashiCorp Vault or Terraform, AWS, CKA, or PlainID/PingAuthorize certifications are a plus.
• Clear communicator who can explain secure patterns to engineering teams, and is pragmatic in balancing security with developer experience and speed of delivery.

Work at the Point of Impact

We need to be forward-looking to attract the right people to help us become the Leading Global Long-term Investor. Join our ambitious, agile, and diverse teams - be empowered to push boundaries and pursue innovative ideas, share your views, and be heard. Be anchored on our PRIME Values: Prudence, Respect, Integrity, Merit and Excellence, which guides us in how we make our day-to-day decisions. We strive to inspire. To make an impact.

GIC is a Great Place to Work

At GIC, our offices are vibrant hubs for ideation, professional growth, and interpersonal connection. At the same time, we believe that flexibility allows us to do our best work and be our best selves. Thus, our teams come into the office four days per week to harness the benefits of in-person collaboration, but have the flexibility to choose which days they work from home and adjust this arrangement as situational needs arise.

GIC is an equal opportunity employer

As an employer, we passionately believe every individual brings with them unique diversity of thought and perspectives to meaningfully enrich perspectives of GIC teams to drive competitive performance. An inclusive environment yields exceptional contribution.

Learn more about our Technology Group here:

https://gic.careers/group/technology-group/