Head of IT & Security

Role Purpose: You’ll lead Diraq’s global IT and cyber security operations, reporting into the executive team. Your job is to make sure technology and security services and controls are properly resourced, well run and improving, so Diraq can support secure, reliable and scalable research, engineering and business operations across Australia and the United States.
This is a leader-of-leaders role. You’ll set direction, build the operating model, decide where people and budget go, manage the risks that matter and hold two functional managers to their plans. Day-to-day platforms, tooling, service queues and technical processes sit with those managers. This is a scale-up, so staying close enough to the technical detail to step in where needed is part of the role.
About the Role: You’ll lead through two managers: IT & Infrastructure, and IT Security Operations. Your job is to make sure both teams have clear ownership, capable leadership, processes suited to Diraq’s size, effective controls, and enough capacity to keep pace with growth.
You’ll work closely with the Information Security & Risk Manager, turning the requirements set through the ISMS, security standards and risk framework into funded, operational capability. You’ll also give the CFO and Executive Leadership Team a clear view of how services are performing, where the risks are, where investment should go and what decisions are needed.
Key Accountabilities:
What You’ll Own

• Strategy and operating model: you’ll set the global IT and security operations strategy, operating model and roadmap, keep it scalable as Diraq grows, and give the CFO and Executive Leadership Team a clear view of performance, risk and investment priorities. Security risk and control reporting flowing through the ISMS forums owned by the Information Security & Risk function.
• Leadership: you’ll manage, coach and develop the IT & Infrastructure Manager and the IT Security Operations Manager, build depth and succession beneath them, and run a team that research, engineering and corporate colleagues find easy to work with.
• Service performance: you’ll run IT and security operations to agreed service levels and control requirements across labs, engineering, research and corporate, address the causes of recurring problems rather than the symptoms, and keep a realistic view of readiness, capacity and key-person risk.
• Cyber security operations: you’ll make sure monitoring, detection, response and vulnerability remediation are working as intended, act as the senior escalation point during major incidents under the incident framework owned by the Information Security & Risk function, and convert the lessons into funded fixes that get delivered.
• Identity, backup and recovery: you’ll run identity and access management and the joiner, mover and leaver process, implement the access and least-privilege standards set by the Information Security & Risk function, and keep backup and disaster recovery tested against the recovery objectives agreed through business continuity governance.
• Secure engineering: you’ll give Engineering the DevSecOps tooling and the repository, secrets and supply chain security capability needed to meet the requirements set by the Information Security & Risk function, while Engineering remains responsible for adoption in its own pipelines.
• Budget and partners: you’ll run the IT and security portfolio budget and investment plan, hold vendors and managed service providers to clear commercial outcomes, and make sure the security requirements set by the Information Security & Risk function are reflected in contracts.

• 10+ years across technology, infrastructure, cyber security or IT service environments, including time leading managers.
• A track record of building and scaling operating models in global or distributed technology teams.
• Strong practical understanding of cloud, infrastructure, identity, cyber security operations, resilience and service management, with the judgement to direct specialists without becoming the primary operator.
• Experience managing material budgets, investment portfolios, vendors and service providers, and translating operational data into executive decisions.
• You’re able to get outcomes through influence across Engineering, Research, Finance, Legal, Security Governance and People & Culture.
• You’ve led through major operational or cyber incidents at a senior level.
• Experience in deep-tech, semiconductor, quantum, defence or R&D environments is highly desirable.

• Strategy and operating model: you’ll set the global IT and security operations strategy, operating model and roadmap, keep it scalable as Diraq grows, and give the CFO and Executive Leadership Team a clear view of performance, risk and investment priorities. Security risk and control reporting flowing through the ISMS forums owned by the Information Security & Risk function.
• Leadership: you’ll manage, coach and develop the IT & Infrastructure Manager and the IT Security Operations Manager, build depth and succession beneath them, and run a team that research, engineering and corporate colleagues find easy to work with.
• Service performance: you’ll run IT and security operations to agreed service levels and control requirements across labs, engineering, research and corporate, address the causes of recurring problems rather than the symptoms, and keep a realistic view of readiness, capacity and key-person risk.
• Cyber security operations: you’ll make sure monitoring, detection, response and vulnerability remediation are working as intended, act as the senior escalation point during major incidents under the incident framework owned by the Information Security & Risk function, and convert the lessons into funded fixes that get delivered.
• Identity, backup and recovery: you’ll run identity and access management and the joiner, mover and leaver process, implement the access and least-privilege standards set by the Information Security & Risk function, and keep backup and disaster recovery tested against the recovery objectives agreed through business continuity governance.
• Secure engineering: you’ll give Engineering the DevSecOps tooling and the repository, secrets and supply chain security capability needed to meet the requirements set by the Information Security & Risk function, while Engineering remains responsible for adoption in its own pipelines.
• Budget and partners: you’ll run the IT and security portfolio budget and investment plan, hold vendors and managed service providers to clear commercial outcomes, and make sure the security requirements set by the Information Security & Risk function are reflected in contracts.