{"id":1246496,"url":"https://alion.io/job/tng-digital-specialist-identity-access-management","title":"Specialist, Identity Access Management","company":{"id":49668,"name":"TNG Digital","domain":"tngdigital.com.my","url":"https://alion.io/company/tng-digital","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":null,"truth_index":null},"role":"Security","role_family":"Security","seniority":"middle","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Kuala Lumpur, Malaysia"],"countries":["MY"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":14000,"max_usd":33000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":714},"experience_years_min":3,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"CI/CD","optional":false},{"name":"IAM","optional":false},{"name":"Kubernetes","optional":false},{"name":"Least Privilege","optional":false},{"name":"Microsoft Entra ID","optional":false},{"name":"PCI DSS","optional":false}],"status":"closed","first_seen_at":"2026-09-25T17:22:53Z","employer_posted_date":null,"last_verified_at":"2026-10-20T04:58:45Z","board_verified":false,"closed_at":"2026-10-20T04:58:45Z","days_open":24,"trust":{"level":"not_scored","repost_count":null,"flags":[],"days_open":24},"description":"At TNG Digital, part of TNG Digital Group, we build the tech behind TNG eWallet, one of Malaysia's most used apps for payments and everyday life.\n\nMillions of people rely on us daily, not just to pay, but to manage money, access financial services, and get things done faster and simpler.\n\nBehind it all is a team that likes to question how things are done, move quickly, and try new ideas. If you enjoy solving real problems and seeing your work used at scale, you will feel right at home here.\n\nWhat You'll Do:\nResponsible in reviewing access control for all existing system, application across enterprise and to propose improvement/enhancement.\nManage privileged and non-human identities, including service accounts, application identities, RAM Roles, Service Principals, AK/SK, API tokens, certificates, and secrets. \nTo consolidate and streamline existing access control (SSO etc), including staff onboarding and offboarding process.\nOverseeing the provisioning and deprovisioning of user accounts, managing access rights, and monitoring user activity to ensure compliance with security policies.\nDesign and implement Alibaba Cloud RAM Roles, RAM Policies, STS AssumeRole, RRSA and OIDC federation. \nManage Alibaba Cloud KMS and Secrets Manager, including KMS instances, keys, secrets, permissions, access policies, rotation, expiration, and lifecycle management. \nDefine strict separation between KMS administration, key usage, secret management, and secret-value retrieval. \nControl and review permissions such as Encrypt, Decrypt, GetSecretValue, key management, and secret management based on least privilege. \nImplement secure storage and rotation of AK/SK, API tokens, application secrets, database credentials, certificates, and other sensitive credentials using approved secrets-management solutions. \nAssess requests for long-lived AK/SK and recommend RAM Roles, STS, OIDC, workload identity, or KMS Secrets Manager where technically feasible. \nManage Microsoft Entra ID App Registrations, Enterprise Applications, Service Principals, Managed Identities, client secrets, certificates, API permissions, and workload identity federation. \nSupport secure authentication for applications, scripts, CI/CD pipelines, Kubernetes/ACK workloads, automation, and cloud services. \nIdentify and remediate unused, excessive, expired, orphaned, shared, or improperly stored credentials and secrets. \nEstablish and enforce credential and cryptographic key rotation standards. \nMonitor privileged identities, KMS activities, secret retrieval, and credential usage for suspicious or unauthorized activities. \nSupport periodic User Access Reviews (UAR), privileged-access reviews, service-account reviews, and KMS access reviews. \nDevelop automation for identity provisioning, credential rotation, secret lifecycle management, access reviews, and revocation. \nSupport audit and regulatory requirements relating to identity, privileged access, cryptographic keys, secrets, and authentication credentials.\nTo manage user access to systems, applications, and data with development of proper user matrices\nTo monitor compliance with policies, regulations, and customer requirements.\nTo assist in all risk assessments and audits related assignments.\nInvestigate incidents and recommend corrective actions.\nTo instill users awareness on policies and procedures related to IAM via training, email etc\nStay up to date on evolving threats, technologies, and solutions.\nCollaborate with other departments to ensure secure access to systems and data.\nMaintaining up-to-date knowledge of emerging IAM technologies, trends, and threats, and making recommendations to improve the organization's security posture.\n\nRole Requirements:\nBachelor's degree in computer science, information technology, or a related field.\nPrior experience in managing cloud security on CSP such as Alicloud, Azure and AWS.\nMinimum of 3 - 5 years of experience in IAM or related fields, such as cybersecurity or information security.\nExperience with IAM technologies, such as identity and access governance, access control systems, and identity federation.\nExperience in IAM solution implementation (project management, working level, hands-on implementation)\nStrong experience designing and governing access controls, SSO, user provisioning/deprovisioning, role-based access, user access matrices and periodic access reviews across enterprise systems.\nProven ability to manage privileged accounts, service accounts, application identities, API tokens, certificates and other non-human identities throughout their lifecycle.\nHands-on expertise in Alibaba Cloud RAM, STS, RRSA and OIDC federation, as well as Microsoft Entra ID App Registrations, Service Principals, Managed Identities and workload identity federation.\nExperience managing cryptographic keys and secrets using KMS and Secrets Manager, including least-privilege access, separation of duties, secure storage, rotation, expiration, monitoring and revocation.\nAbility to automate identity and credential processes, monitor suspicious access activities, support incident investigations, and demonstrate compliance with security policies, audits and regulatory requirements.\nStrong knowledge of security frameworks and regulations, such as BNM RMiT, PCI DSS etc.\nExcellent communication and interpersonal skills, with the ability to interact with stakeholders at all levels of the organization.\nRelevant industry certifications, such as Certified Information Systems Security Professional (CISSP) or Certified Information Security Manager (CISM), are preferred.\n\nWhat You Get\nWork your way\nFlexible working hours\nYour wellbeing matters\nMedical coverage, with option to include dependants\nExtra leave for family and caregiving needs\nRewards that grow with you\nMonthly lifestyle allowance via TNG eWallet\nLong-term rewards for your contributions\nEveryday support\nMobile and broadband reimbursement\nDiscounts and wellness perks\n\nWhat it's like to work here\nWe care about people who take ownership, speak up, and want to make things better. Titles matter less than impact. Good ideas can come from anyone.\n\nYou will be working with people who are curious, practical, and not afraid to challenge each other in a good way.\n\nNote: Only shortlisted candidates will be contacted.","description_format":"text","description_chars":6288,"description_truncated":false,"requirements":{"experience_years_min":3,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Flexible schedule"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":[],"lifecycle":[{"event":"open","at":"2026-09-25T17:22:53Z"},{"event":"close","at":"2026-10-20T04:58:45Z"}],"visa":[],"liveness":null,"pay":null,"html_url":"https://alion.io/job/tng-digital-specialist-identity-access-management","json_url":"https://alion.io/job/tng-digital-specialist-identity-access-management.json","meta":{"generated_at":"2026-10-29T15:51:45Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":23772,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-30T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":49668},"rest":"https://alion.io/mcp/rest/get_company?id=49668"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Ftng-digital-specialist-identity-access-management"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Ftng-digital-specialist-identity-access-management"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Ftng-digital-specialist-identity-access-management"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/tng-digital-specialist-identity-access-management\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Ftng-digital-specialist-identity-access-management"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":1246496}},{"tool":"search_jobs","arguments":{"company":"tngdigital.com.my","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":1246496},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}