The posting
Job description
You will lead Diraq’s IT Security, Cyber Security and DevSecOps capabilities, translating approved security policies, standards and control requirements into effective technical and operational outcomes. You will build a disciplined and responsive function across identity and access security, monitoring, detection, incident response, vulnerability management, technical security controls and secure delivery, while remaining close enough to the work to step in when needed.
This is a hands-on leadership role within a scaling deep-tech environment. You will prioritize operational risk, strengthen capability, improve tooling and processes, and partner with Research, Product & Technology and IT & Infrastructure to protect cloud, on-premises, laboratory and secure development environments across Australia and the United States.
About the Role Reporting to the Head of IT & Security, you will own the performance of the IT Security function and provide clear visibility of incidents, threat activity, vulnerabilities, remediation progress and technical control health. You will operate within the governance framework established by the Information Security & Risk Manager, who independently owns the ISMS, policies, standards, security risk framework and assurance program.
The function’s remit includes IT Security, Cyber Security and DevSecOps across Diraq’s Australia and United States operations. It covers security monitoring and triage, identity and access security, threat detection, incident response, vulnerability management, technical security controls, and secure software and cloud delivery. DevSecOps responsibilities include CI/CD security controls, secrets management, secure Infrastructure as Code, software supply chain protection, cloud guardrails and automated compliance evidence.
You will work closely with the IT & Infrastructure Manager where security controls depend on identity platforms, endpoints, networks, cloud services, backup, recovery and service operations. You will also act as the local point of contact for Diraq’s other US-based IT team members who report to the Sydney-based IT & Infrastructure Manager. This is a dotted-line support and escalation relationship, not a reporting line. Essential
- 8+ years of experience across IT Security, Cyber Security, DevSecOps, infrastructure security or related technical disciplines, including experience leading and developing multidisciplinary security capability.
- Demonstrated experience running security monitoring, incident response, vulnerability management and technical remediation in complex environments.
- Strong practical knowledge across cloud security, identity, endpoints, networks, Linux and Windows systems, with the judgement to direct specialist activity and contribute hands-on when required.
- Experience operating and improving SIEM, EDR/XDR, vulnerability management, identity security or related security platforms.
- Experience leading or managing DevSecOps or secure delivery capability, including repository, secrets, software supply chain and CI/CD security controls such as SAST, DAST, SCA and policy checks.
- Practical depth in public cloud security, including identity and permission boundaries, guardrail policies, encryption and key management, security posture management, Infrastructure as Code, policy-as-code, and container and orchestration security.
- Ability to translate policies, standards and risk requirements, including applicable ISO/IEC 27001:2022 Annex A controls and relevant NIST Cybersecurity Framework 2.0 outcomes, into practical technical plans, operational processes and measurable results.
- Experience managing vendors or managed service providers and communicating operational risk, incidents and investment needs to senior stakeholders.
- Clear written and verbal communication, sound judgement, discretion and a collaborative approach in environments handling sensitive information.
Highly Regarded
- Experience in deep tech, semiconductor, quantum, defence, aerospace, R&D or another highly technical or regulated environment.
- Experience protecting source code, research data, intellectual property or export-controlled technical information.
- Experience supporting distributed operations across Australia and the United States, including hybrid cloud, SaaS, on-premises, software delivery and laboratory environments.
- Familiarity with PCI DSS requirements or other externally driven control obligations.
- Relevant certifications such as CISSP, CISM, GIAC, OSCP, Security+, a major cloud provider security specialty certification, ISO 27001 Lead Implementer or Lead Auditor, or other cloud security or vendor-specific credentials. Practical capability and leadership judgement are more important than certifications alone.
IT Security leadership
- Lead, coach and develop the IT Security function across IT Security, Cyber Security and DevSecOps, setting clear accountabilities, priorities, ways of working and measurable service expectations.
- Build an operating rhythm for work intake, prioritisation, escalation, incident readiness, reporting and continuous improvement across both regions.
- Maintain practical workforce, capability, service coverage and succession plans, using specialist vendors or managed services where they provide appropriate capability or coverage.
Monitoring, detection and response
- Own security monitoring, alert triage, threat detection and operational response across relevant cloud, endpoint, identity, network, infrastructure, research and software delivery environments.
- Lead live cyber incident response and recovery execution, escalating major incidents to the Head of IT & -Security and operating under the incident governance framework defined by Information Security & Risk.
- Ensure incidents are investigated, contained, documented and followed by root-cause analysis, lessons learned and tracked remediation.
- Set triage levels, escalation thresholds, incident coverage arrangements and response expectations across time zones, ensuring operational runbooks and playbooks remain current and tested.
Vulnerability and technical security controls
- Own the operational vulnerability management lifecycle, including discovery, prioritization, remediation coordination, exception escalation, verification and reporting.
- Implement, operate and maintain technical security controls in accordance with approved policies, standards and control requirements.
- Monitor control health and effectiveness, address operational gaps and provide evidence to support assurance, audit and risk treatment activities.
Identity, access and platform security
- Lead the security design, oversight and control operation for identity, privileged access and joiner, mover and leaver processes, working with IT & Infrastructure and People & Culture on provisioning, changes and deprovisioning.
- Implement least-privilege, need-to-know and access review requirements defined by Information Security & Risk.
- Drive practical hardening and security improvement across cloud services, endpoints, Linux and Windows systems, networks and relevant laboratory or research environments, including permission boundaries, segmentation, encryption and key management, security posture management and policy-as-code guardrails.
DevSecOps and secure delivery
- Own the DevSecOps capability and the operation of secure software and cloud delivery controls, including automated security testing and policy checks in CI/CD pipelines, secrets management and rotation, software supply chain and repository controls, reusable secure Infrastructure as Code, and container and orchestration security.
- Partner with software, platform and technology leaders to embed security requirements into delivery workflows, conduct security architecture reviews, and enable secure cloud and coding practices. The IT -Security function will operate agreed shared security controls, while delivery teams remain accountable for applying those controls within their workflows.
- Support investigation and remediation of security issues affecting source code, technical data, research systems and controlled technology.
- Maintain traceability between implemented technical controls, applicable ISO/IEC 27001:2022 Annex A controls and relevant NIST Cybersecurity Framework 2.0 outcomes. Use automated compliance checks, drift detection and evidence collection to support the assurance program owned by Information Security & Risk.
Performance, suppliers and stakeholder partnership
- Define and report meaningful operational metrics covering detection, incidents, vulnerabilities, remediation, service capacity and technical control performance.
- Manage security vendors and service providers against clear technical, service and commercial outcomes, and contribute to budget and investment planning.
- Work constructively with Information Security & Risk, Legal & Compliance, Export Controls, Research, Product & Technology and IT & Infrastructure to turn requirements and risks into deliverable technical outcomes.
Job benefits
- Competitive total compensation package, including salary and equity.
- Comprehensive health cover plan.
- 401(k) retirement plan or similar retirement support.
- Paid time off and company holidays.
- Flexible working arrangements.
Salary range
160,000 – 190,000 USD Annual
