The posting
ASX: Powering Australia's financial markets
Why join the ASX?
When you join ASX, you’re joining a company with a strong purpose – to power a stronger economic future by enabling a fair and dynamic marketplace for all.
In your new role, you’ll be part of a leading global securities exchange with a strong brand. We are known for being a trusted market operator and an exciting data hub.
Want to know why we are a great place to work, click on the link to learn more.
www.asx.com.au/about/careers/a-great-place-to-work
We are more than a securities exchange!
The ASX team brings together talented people from a diverse range of disciplines.
We run critical market infrastructure, with 1 in 3 people employed within technology. Yet we have a unique complexity of roles across a range of disciplines such as operations, program delivery, financial products, investor engagement, risk and compliance.
We’re proud to foster a workplace where diversity is celebrated and inclusion is part of our everyday culture. Our employee-led networks champion LGBTIQ+ inclusion, promote gender equality, accessibility and wellbeing, inspire giving and volunteering, and celebrate cultural and religious events, creating a sense of belonging for all. As an AWEI Bronze employer and member of the Champions of Change Coalition for gender equality, we’re committed to a fair and inclusive workplace where everyone can thrive.
Your Team
The Cyber Security team protects ASX’s systems, data and critical services through cyber governance, risk management, security engineering, identity security and threat response. The Identity Security team operates identity as a primary enterprise security control across workforce, privileged, customer, machine and emerging identities. It enables trusted access to ASX systems, platforms and digital services while reducing identity-related cyber risk and supporting the resilience of critical market infrastructure.
Your responsibilities
Lead and transform the enterprise Identity Security function, setting strategy and overseeing the design, delivery, assurance and operation of identity capabilities. Provide strategic, technical and people leadership that strengthens access controls, improves business and customer outcomes, embeds cyber resilience and shifts the function from operational service delivery towards proactive identity risk management and measurable control effectiveness.
- Set and deliver the enterprise identity security strategy, roadmap, architecture and operating model, aligned with ASX’s cyber strategy, risk appetite, technology priorities and critical-infrastructure obligations.
- Own five integrated capability domains: identity governance and administration; privileged identity security; enterprise identity and authentication; customer identity and digital trust; and machine, workload and emerging identity security.
- Lead identity governance and administration across the full lifecycle, including joiner, mover and leaver processes, access requests, approvals, provisioning, entitlement governance, segregation of duties, role and attribute-based access, recertification, contractor lifecycle, and orphaned or dormant identities.
- Oversee the operating effectiveness of lifecycle controls and use automation to improve control reliability, timeliness, scalability and user experience.
- Lead privileged identity security across infrastructure, databases, cloud, SaaS, Entra roles, DevOps, emergency access, service identities, credentials and secrets. Minimise standing privilege, use Just-In-Time and Just-Enough Administration where appropriate, and manage standing access as an approved exception.
- Define and enforce enterprise standards for authentication, authorisation, federation, single sign-on, multi-factor authentication, Conditional Access and least privilege. Progress access towards risk-aware and adaptive controls based on identity risk, privilege, device posture and service criticality.
- Lead customer identity and digital trust, setting direction for secure, resilient and efficient authentication, authorisation, federation, credential management and identity lifecycle services for customers, market participants and digital channels.
- Establish and govern machine, workload and emerging identity security, including service and application accounts, cloud workload identities, API credentials, certificates, cryptographic keys, automation identities, secrets and AI agent identities. Require named ownership, approved purpose, least privilege, managed credential lifecycle, monitoring and expiry or review.
- Ensure identity platforms and services are secure, resilient, scalable and supported by effective service management, patching, monitoring, disaster recovery, incident response and workforce continuity. Maintain tested capability to operate priority services during technology disruption, loss of remote access or a material cyber incident.
- Preserve and strengthen identity assurance by owning control design and operating effectiveness, regulatory obligations, audit engagement, evidence quality, issue remediation and risk acceptance. Embed audit readiness and control ownership across multiple roles rather than any single individual.
- Establish metrics, tolerances and dashboards covering access risk, lifecycle performance, privileged access, orphaned accounts, recertification, platform health, service resilience and control effectiveness; use them to identify deterioration, assign owners and drive corrective action.
- Integrate identity telemetry with cyber detection and response, and ensure identity threats, credential compromise, privilege escalation and anomalous access are reflected in monitoring and incident playbooks.
- Partner with Technology, Cyber Security, Risk, People and Culture, Product and Business teams to embed identity-by-design into transformation and change. Establish clear accountabilities, challenge weak designs and intervene where delivery choices create unacceptable security or resilience exposure.
- Own prioritisation, delivery commitments, dependencies and escalation across the portfolio, including outcomes committed to executives, the Board, auditors and regulators.
- Manage strategic vendors, licensing, managed services and delivery partners to achieve service, security, resilience and commercial outcomes.
- Build, mentor and lead a high-performing team with strong engineering, governance, customer and operational disciplines. Create an accountable and inclusive culture in which development and flexibility are balanced with performance, collaboration, service reliability, on-site resilience and enterprise obligations.
Your experience and qualifications
Must have
- Experience: 10+ years in technology, cyber security or identity, including substantial leadership of enterprise IAM, identity security or major transformation programs. Demonstrated success leading organisational change and improving security, resilience, service performance and control effectiveness.
- Identity security expertise: Deep knowledge of identity governance, privileged identity security, authentication, authorisation, federation, customer identity, cloud identity and non-human identity security.
- Threat perspective: Strong understanding of identity-based attack paths, credential compromise, privilege escalation, session abuse and the use of identity telemetry in detection and response.
- Technology leadership: Demonstrated experience leading capabilities spanning identity governance, privileged access, customer identity, enterprise authentication, cloud identity and machine identity. Credibility with platforms such as SailPoint, BeyondTrust, ForgeRock, Microsoft Entra ID, Active Directory, Conditional Access, Privileged Identity Management and enterprise secrets-management technologies, without needing to be the deepest specialist in every product.
- Risk, control and resilience: Strong command of least privilege, segregation of duties, access certification, control evidence, audit and regulatory engagement, disaster recovery, incident management and critical-service continuity.
- Leadership and communication: Proven ability to transform operational teams into strategic, outcome-focused capabilities; set clear expectations; develop leadership depth; influence senior stakeholders; and translate complex identity risks and investment needs into business outcomes.
Nice to have
- Experience within financial services, market infrastructure, banking, payments, clearing or another highly regulated or critical-infrastructure environment.
- Experience delivering identity modernisation, Zero Trust, cloud identity, adaptive authentication, secrets management or machine-identity programs.
- Experience modernising customer identity platforms and engineering practices in cloud or containerised environments.
- Relevant qualifications or certifications in cyber security, identity, cloud, risk or technology leadership.
We make hiring decisions based on your skills, capabilities and experience, and how you’ll help us to live our values. We encourage you to apply even if you don’t meet all the criteria of this role.
If you need any adjustments during the application or interview process to help you present your best self, please let us know at [email protected].
At ASX Group, our diverse workforce is essential to build and maintain a fair and dynamic marketplace. We support flexible working and offer hybrid working options. Even if our roles are advertised as full-time, we encourage you to apply if you are interested in part-time or other flexible working arrangements.
We will arrange for successful candidates to have background checks, including reference and police checks, completed as part of the on-boarding process.
To be considered for this position, candidates must be legally authorised to work in Australia on a permanent basis without any restrictions.
