IT & Cybersecurity Executive (Senior-Lead)

KEY RESPONSIBILITIES

A. Microsoft 365 E3/E5 Platform Administration

The candidate will be responsible for the day-to-day administration and security configuration of the organization's Microsoft 365 E3/E5 tenant, serving as the primary M365 administrator:

• Administer user accounts, licences, groups (Entra ID), and conditional access policies in Microsoft Entra ID (formerly Azure AD) — including MFA enforcement, passwordless authentication setup, and guest access governance.

• Configure and maintain Microsoft Defender for Business for endpoint protection across all company devices — including threat policies, antivirus profiles, attack surface reduction rules, and alert triage.

• Deploy and manage Microsoft Intune for Mobile Device Management (MDM) and Mobile Application Management (MAM), covering device enrolment, compliance policies, and configuration profiles for Windows and mobile endpoints.

• Manage Microsoft Purview compliance solutions — including Data Loss Prevention (DLP) policies, sensitivity labels, retention policies, communication compliance, and eDiscovery as required.

• Administer Microsoft Defender for Office 365 (Plan 1/2 equivalent) — including Safe Links, Safe Attachments, anti-phishing policies, and spoof intelligence.

• Configure and maintain Microsoft Sentinel (SIEM) for log ingestion, security event correlation, alert rules, and incident tracking. Develop and maintain basic KQL queries for monitoring and reporting.

• Operate and maintain Microsoft Teams as the primary collaboration platform — including channel governance, meeting policies, external access controls, and Teams Phone configurations where applicable.

• Manage SharePoint Online and OneDrive for Business — including site provisioning, permission structures, external sharing policies, and information architecture in alignment with the organization's data classification policy.

• Maintain Exchange Online — including mail flow rules, anti-spam/anti-malware policies, shared mailboxes, distribution lists, and calendar management.

• Monitor the Microsoft 365 Secure Score dashboard and implement recommended improvement actions on a scheduled cadence. Produce monthly security posture reports for management review.

• Administer Microsoft 365 Backup and support disaster recovery testing as scheduled.

• Manage the migration path from Microsoft 365 Business plans to E3/E5 licensing as required — including licence reconciliation, feature parity checks, and user communications.

B. ISO/IEC 27001:2022 ISMS Implementation Support

The candidate will work directly with management to support the organization's ISO/IEC 27001:2022 certification programme, acting as the primary documentation and operational owner for the ISMS:

• Maintain and regularly update the ISMS document registry — including the Statement of Applicability (SoA), Risk Register, Asset Register, and all mandatory ISMS records as required by Clauses 5, 6, 7, 8, 9, and 10 of ISO/IEC 27001:2022.

• Conduct scheduled information security risk assessments using the organization's defined risk assessment methodology — identifying threats, vulnerabilities, likelihood, and impact across information assets.

• Coordinate and document internal ISMS audits in accordance with the audit programme — including scheduling, checklist preparation, evidence collection, finding documentation, and corrective action tracking.

• Manage the corrective action and nonconformity register — tracking root cause analyses, remediation actions, responsible owners, and closure deadlines.

• Support the preparation and coordination of external surveillance audits and the initial certification audit by the appointed certification body (CB).

• Conduct and document information security awareness training sessions for all staff — covering phishing awareness, clean desk policy, data handling, acceptable use, and incident reporting procedures.

• Maintain the Supplier and Third-Party Security Assessment process — including vendor risk questionnaires, contract clause reviews, and periodic reassessments for critical service providers.

• Monitor the organization's compliance posture against all applicable controls in Annex A of ISO/IEC 27001:2022, and maintain gap tracking documentation.

• Support management review meetings by preparing ISMS performance metrics, KPI dashboards, and input data covering audit results, incident statistics, risk treatment status, and security objective progress.

C. Security Policy Framework — Operationalization & Compliance

The organization has established a twelve-policy information security framework. The candidate will own the operationalization, monitoring, and periodic review of all policies:

• Information Security Policy (Master) — maintain as living document; ensure all referenced sub-policies remain current and consistent.

• Acceptable Use Policy (AUP) — enforce via Intune compliance baselines and M365 communication compliance; conduct periodic user attestation exercises.

• Access Control Policy — maintain Role-Based Access Control (RBAC) matrices; conduct quarterly Privileged Access Reviews (PAR) across M365, SharePoint, and connected systems.

• Data Classification & Handling Policy — implement and enforce via Microsoft Purview sensitivity labels; ensure all shared documents are appropriately labelled before distribution to clients and partners.

• Incident Response Policy — maintain and periodically test the Incident Response Plan (IRP); manage the incident log and ensure timely escalation and reporting.

• Business Continuity & Disaster Recovery Policy — maintain BC/DR documentation; coordinate at least one tabletop exercise annually.

• Change Management Policy — operate the IT change request and approval workflow; maintain the change log.

• Password & Authentication Policy — enforce MFA, password less authentication, and password complexity via Entra ID Conditional Access and Intune. Administer the corporate password manager.

• Physical & Environmental Security Policy — conduct periodic office security walkthroughs; maintain the clean desk checklist and visitor log; coordinate with building management on physical access controls.

• Mobile Device & Remote Access Policy — enforce via Intune device compliance policies; maintain the approved device register.

• Third-Party & Supplier Security Policy — manage vendor onboarding security assessments; maintain the Approved Vendor Register.

• Data Retention & Destruction Policy — implement retention labels in M365 Purview; coordinate secure media disposal as required.

D. Endpoint, Network & Infrastructure Security Operations

As the organization's primary IT operator, the candidate will manage day-to-day security operations across the IT environment:

• Manage endpoint security posture across all Windows workstations and mobile devices — including patch management (Windows Update for Business / Intune), vulnerability scanning, and remediation tracking.

• Monitor and maintain the organization's email security posture — including DMARC, DKIM, and SPF records; review quarantine reports and respond to phishing reports from end users.

• Administer the corporate SSH (Tailscale) solution for remote access — managing user provisioning, connection policies, and access logs.

• Monitor network security appliances (firewall, switch management) in coordination with the organisation's managed services provider (MSP) or network vendor, and escalate anomalies.

• Operate Microsoft Sentinel — reviewing security alerts, investigating incidents, maintaining playbooks, and producing regular threat intelligence summaries relevant to the semiconductor and engineering sector.

• Perform vulnerability assessments using approved tools on a scheduled basis — documenting findings and tracking remediation in the risk register.

• Manage DNS, domain registrar settings, SSL certificate renewals, and web hosting security configurations as applicable.

• Support IT asset lifecycle management — procurement requests, asset tagging, configuration, deployment, and secure decommissioning.

E. SEMI E187 / E188 Cybersecurity Compliance Awareness

As a semiconductor facility design consultancy serving Tier-1 fabs, the organization must demonstrate awareness of and alignment with semiconductor-specific cybersecurity standards:

• Develop and maintain working knowledge of SEMI E187 (Cybersecurity Specification for Fab Equipment) and SEMI E188 (Malicious Software Prevention for Fab Equipment).

• Support the preparation of documentation and responses related to client cybersecurity requirements referencing SEMI E187 / E188, NIST SP 800-82, and IEC 62443 as applicable to the organization's scope.

• Coordinate with client security teams (Advanced Nodes Manufacturers) on IT/OT interface requirements, data transfer procedures, and supplier security questionnaire responses.

• Maintain awareness of ITRS Group semiconductor facility security guidelines and incorporate relevant controls into the organization's security posture where applicable.

F. Collaboration Platforms & Productivity Tools Administration

• Administer Autodesk Construction Cloud (ACC) and BIM Collaborate Pro — including user provisioning, project workspace setup, access control, and document permission management for engineering project teams.

• Support onboarding of Revit cloud work sharing workflows via ACC BIM Collaborate Pro, in coordination with the engineering team.

• Administer other productivity and project management tools as adopted by the organization — maintaining user access, licence management, and security integration.

• Provide tier-1 and tier-2 IT helpdesk support to all Singapore staff — including hardware/software troubleshooting, M365 support, account management, and device configuration.

QUALIFICATIONS & EXPERIENCE

Minimum Academic Qualifications

• Bachelor's Degree in Information Technology, Computer Science, Cybersecurity, Information Systems, or a related discipline from a recognized institution.

• At least 5-8 years of relevant experience with at least three (3) years of relevant IT/cybersecurity work

Preferred Certifications (not all required — any of the following is advantageous)

• Microsoft Certified: Security, Compliance, and Identity Fundamentals (SC-900)

• Microsoft Certified: Azure Administrator Associate (AZ-104) or M365 Administrator Associate (MS-102)

• Microsoft Certified: Security Operations Analyst Associate (SC-200)

• CompTIA Security+ or CompTIA CySA+

• Certified Information Systems Security Professional (CISSP) Associate or SSCP — advantageous but not required at junior level

• ISO/IEC 27001 Lead Implementer or Internal Auditor certificate (PECB, BSI, or equivalent) — highly advantageous

• ITIL 4 Foundation — advantageous for service management context

Work Experience Profile

• Prior internship or employment in an IT administration, IT helpdesk, or cybersecurity support role is preferred but not mandatory for fresh graduates.

• Demonstrable hands-on exposure to Microsoft 365 administration — even through self-study, certifications, or lab environments — is strongly valued.

• Exposure to ISO 27001 documentation or ISMS-related project work (academic, internship, or professional) is an advantage.

• Experience working in a small-to-medium enterprise (SME) context where the role demands multitasking and broad ownership across IT functions is preferred over large-enterprise single-function experience.

  Interested Parties please WhatsApp/Call us at 8893 3424 (Jasmine), and email your latest resume in WORD format to jl@businessedge.com.sg. You may call my office number at 65698233 (Ext.839) for a private & confidential discussion. EA License No.: 96C4864 Reg No.: R22108682 Lee Yit Foong Jasmine