Workspace Security Engineer (AVP/VP)

WHO WE ARE: As Singapore’s longest established bank, we have been dedicated to enabling individuals and businesses to achieve their aspirations since 1932. How? By taking the time to truly understand people. From there, we provide support, services, solutions, and career paths that meet their individual needs and desires. Today, we’re on a journey of transformation. Leveraging technology and creativity to become a future-ready learning organisation. But for all that change, our strategic ambition is consistently clear and bold, which is to be Asia’s leading financial services partner for a sustainable future. We invite you to build the bank of the future. Innovate the way we deliver financial services. Work in friendly, supportive teams. Build lasting value in your community. Help people grow their assets, business, and investments. Take your learning as far as you can. Or simply enjoy a vibrant, future-ready career. Your Opportunity Starts Here. Why Join Protecting our customers' assets and data is at the heart of everything we do at OCBC. As a Cyber Engineering - Risk professional, you'll play a critical role in safeguarding our systems and networks from cyber threats. You'll be part of a team that's shaping the future of cybersecurity in the financial industry. How you succeed We are looking for a hands-on Workspace Security Engineer to strengthen our security engineering capability across Microsoft endpoint and modern workplace technologies. This role is suited to an experienced EUC or modern workplace engineer who understands the Microsoft ecosystem and is ready to take deeper ownership of security policy engineering, solution design, automation, and control assurance. The successful candidate will help shape secure endpoint solutions, translate security requirements into practical configurations, evaluate new capabilities, and develop the standards and monitoring needed to protect enterprise user-computing environments. The role offers the opportunity to grow from a strong Microsoft and EUC foundation into broader workspace security engineering ownership. What you do • Engineer Microsoft endpoint and modern workplace security policies, configurations, and technical controls. • Contribute to the workspace security solution roadmap and the continued evolution of endpoint security capabilities. • Translate security requirements and control gaps into practical policy designs, configuration changes, and engineering solutions. • Configure and enhance security capabilities across Microsoft Intune, Microsoft 365, Entra ID, Conditional Access, device compliance, and endpoint-management services. • Engineer and improve security baselines, endpoint protection, attack-surface reduction, application control, device control, vulnerability remediation, and endpoint telemetry. • Evaluate new Microsoft security features and develop recommendations, test plans, and implementation approaches for their adoption. • Define security configuration standards, reference settings, technical guardrails, and exception requirements. • Develop monitoring and reporting capabilities for policy deployment, configuration compliance, control coverage, exceptions, and security effectiveness. • Use PowerShell, Microsoft Graph APIs, scripting, and automation to improve configuration management, validation, evidence collection, and reporting. • Investigate complex endpoint-security issues, policy conflicts, configuration weaknesses, and control failures, and develop sustainable remediation. • Produce clear engineering documentation, test evidence, implementation guidance, and operating procedures. • Collaborate with stakeholders from different functions to deliver effective workspace security controls. • Contribute technical knowledge, reusable engineering practices, and continuous improvement across the wider cybersecurity engineering team. Who you are • Approximately 8 or more years of relevant experience in EUC, endpoint engineering, modern workplace, infrastructure, or cybersecurity within enterprise environments. • Strong hands-on experience with Microsoft Intune, Microsoft 365, Entra ID or Azure AD, Active Directory, Group Policy, device compliance, and Conditional Access. • Practical experience designing, configuring, testing, or modernising endpoint policies, including GPO-to-Intune migration or large-scale device-management initiatives. • Good understanding of endpoint security baselines, identity-driven access, vulnerability remediation, patching, application deployment, device compliance, and secure configuration management. • Ability to analyse security requirements or control gaps and convert them into structured technical solutions and implementation plans. • Experience assessing platform capabilities, identifying limitations, and recommending practical improvements or new feature adoption. • Experience with PowerShell, Microsoft Graph APIs, scripting, workflow automation, or configuration-as-code practices. • Strong troubleshooting, analytical, documentation, communication, and stakeholder-management skills. • Ability to work effectively across security and technology teams in a complex enterprise environment. • Curiosity and willingness to build deeper expertise across Microsoft endpoint security, advanced control engineering, telemetry, and automation. Preferred experience • Microsoft certifications in Azure, Microsoft 365, Security, Compliance and Identity, Endpoint Administration, or related disciplines. • Exposure to Microsoft endpoint protection, application control, attack-surface reduction, security monitoring, vulnerability management, or privileged-workstation security. • Experience supporting Windows and mobile-device security; exposure to macOS security is beneficial. • Experience developing security dashboards, control metrics, compliance reporting, or configuration-assurance automation. • Experience in financial services, regulated industries, or other la…