{"id":4001215,"url":"https://alion.io/job/diraq-it-security-manager","title":"IT Security Manager","company":{"id":60433,"name":"Diraq","domain":"diraq.com","url":"https://alion.io/company/diraq","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"HiBob","truth_index":null},"role":"Leadership","role_family":"Leadership","seniority":"senior","employment_type":null,"work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Santa Monica, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":8,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"CI/CD","optional":false},{"name":"ISO 27001","optional":false},{"name":"Least Privilege","optional":false},{"name":"PCI DSS","optional":false},{"name":"SIEM","optional":false},{"name":"Windows","optional":false}],"status":"live","first_seen_at":"2026-11-09T23:48:37Z","employer_posted_date":"2026-11-10","last_verified_at":"2026-11-10T03:35:19Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"You will lead Diraq’s IT Security, Cyber Security and DevSecOps capabilities, translating approved security policies, standards and control requirements into effective technical and operational outcomes. You will build a disciplined and responsive function across identity and access security, monitoring, detection, incident response, vulnerability management, technical security controls and secure delivery, while remaining close enough to the work to step in when needed. This is a hands-on leadership role within a scaling deep-tech environment. You will prioritize operational risk, strengthen capability, improve tooling and processes, and partner with Research, Product & Technology and IT & Infrastructure to protect cloud, on-premises, laboratory and secure development environments across Australia and the United States.\nAbout the Role\nReporting to the Head of IT & Security, you will own the performance of the IT Security function and provide clear visibility of incidents, threat activity, vulnerabilities, remediation progress and technical control health. You will operate within the governance framework established by the Information Security & Risk Manager, who independently owns the ISMS, policies, standards, security risk framework and assurance program. \nThe function’s remit includes IT Security, Cyber Security and DevSecOps across Diraq’s Australia and United States operations. It covers security monitoring and triage, identity and access security, threat detection, incident response, vulnerability management, technical security controls, and secure software and cloud delivery. DevSecOps responsibilities include CI/CD security controls, secrets management, secure Infrastructure as Code, software supply chain protection, cloud guardrails and automated compliance evidence. \nYou will work closely with the IT & Infrastructure Manager where security controls depend on identity platforms, endpoints, networks, cloud services, backup, recovery and service operations. You will also act as the local point of contact for Diraq’s other US-based IT team members who report to the Sydney-based IT & Infrastructure Manager. This is a dotted-line support and escalation relationship, not a reporting line.\nResponsibilities\nIT Security leadershipLead, coach and develop the IT Security function across IT Security, Cyber Security and DevSecOps, setting clear accountabilities, priorities, ways of working and measurable service expectations.\nBuild an operating rhythm for work intake, prioritisation, escalation, incident readiness, reporting and continuous improvement across both regions.\nMaintain practical workforce, capability, service coverage and succession plans, using specialist vendors or managed services where they provide appropriate capability or coverage.\nMonitoring, detection and responseOwn security monitoring, alert triage, threat detection and operational response across relevant cloud, endpoint, identity, network, infrastructure, research and software delivery environments.\nLead live cyber incident response and recovery execution, escalating major incidents to the Head of IT & -Security and operating under the incident governance framework defined by Information Security & Risk.\nEnsure incidents are investigated, contained, documented and followed by root-cause analysis, lessons learned and tracked remediation.\nSet triage levels, escalation thresholds, incident coverage arrangements and response expectations across time zones, ensuring operational runbooks and playbooks remain current and tested.\nVulnerability and technical security controlsOwn the operational vulnerability management lifecycle, including discovery, prioritization, remediation coordination, exception escalation, verification and reporting.\nImplement, operate and maintain technical security controls in accordance with approved policies, standards and control requirements.\nMonitor control health and effectiveness, address operational gaps and provide evidence to support assurance, audit and risk treatment activities.\nIdentity, access and platform securityLead the security design, oversight and control operation for identity, privileged access and joiner, mover and leaver processes, working with IT & Infrastructure and People & Culture on provisioning, changes and deprovisioning.\nImplement least-privilege, need-to-know and access review requirements defined by Information Security & Risk.\nDrive practical hardening and security improvement across cloud services, endpoints, Linux and Windows systems, networks and relevant laboratory or research environments, including permission boundaries, segmentation, encryption and key management, security posture management and policy-as-code guardrails.\nDevSecOps and secure deliveryOwn the DevSecOps capability and the operation of secure software and cloud delivery controls, including automated security testing and policy checks in CI/CD pipelines, secrets management and rotation, software supply chain and repository controls, reusable secure Infrastructure as Code, and container and orchestration security.\nPartner with software, platform and technology leaders to embed security requirements into delivery workflows, conduct security architecture reviews, and enable secure cloud and coding practices. The IT -Security function will operate agreed shared security controls, while delivery teams remain accountable for applying those controls within their workflows.\nSupport investigation and remediation of security issues affecting source code, technical data, research systems and controlled technology.\nMaintain traceability between implemented technical controls, applicable ISO/IEC 27001:2022 Annex A controls and relevant NIST Cybersecurity Framework 2.0 outcomes. Use automated compliance checks, drift detection and evidence collection to support the assurance program owned by Information Security & Risk.\nPerformance, suppliers and stakeholder partnershipDefine and report meaningful operational metrics covering detection, incidents, vulnerabilities, remediation, service capacity and technical control performance.\nManage security vendors and service providers against clear technical, service and commercial outcomes, and contribute to budget and investment planning.\nWork constructively with Information Security & Risk, Legal & Compliance, Export Controls, Research, Product & Technology and IT & Infrastructure to turn requirements and risks into deliverable technical outcomes.\nRequirements\nEssential8+ years of experience across IT Security, Cyber Security, DevSecOps, infrastructure security or related technical disciplines, including experience leading and developing multidisciplinary security capability.\nDemonstrated experience running security monitoring, incident response, vulnerability management and technical remediation in complex environments.\nStrong practical knowledge across cloud security, identity, endpoints, networks, Linux and Windows systems, with the judgement to direct specialist activity and contribute hands-on when required.\nExperience operating and improving SIEM, EDR/XDR, vulnerability management, identity security or related security platforms.\nExperience leading or managing DevSecOps or secure delivery capability, including repository, secrets, software supply chain and CI/CD security controls such as SAST, DAST, SCA and policy checks.\nPractical depth in public cloud security, including identity and permission boundaries, guardrail policies, encryption and key management, security posture management, Infrastructure as Code, policy-as-code, and container and orchestration security.\nAbility to translate policies, standards and risk requirements, including applicable ISO/IEC 27001:2022 Annex A controls and relevant NIST Cybersecurity Framework 2.0 outcomes, into practical technical plans, operational processes and measurable results.\nExperience managing vendors or managed service providers and communicating operational risk, incidents and investment needs to senior stakeholders.\nClear written and verbal communication, sound judgement, discretion and a collaborative approach in environments handling sensitive information.\n Highly RegardedExperience in deep tech, semiconductor, quantum, defence, aerospace, R&D or another highly technical or regulated environment.\nExperience protecting source code, research data, intellectual property or export-controlled technical information.\nExperience supporting distributed operations across Australia and the United States, including hybrid cloud, SaaS, on-premises, software delivery and laboratory environments.\nFamiliarity with PCI DSS requirements or other externally driven control obligations.\nRelevant certifications such as CISSP, CISM, GIAC, OSCP, Security+, a major cloud provider security specialty certification, ISO 27001 Lead Implementer or Lead Auditor, or other cloud security or vendor-specific credentials. Practical capability and leadership judgement are more important than certifications alone.\nBenefits\nCompetitive total compensation package, including salary and equity.\nComprehensive health cover plan.\n401(k) retirement plan or similar retirement support.\nPaid time off and company holidays. \nFlexible working arrangements.","description_format":"text","description_chars":9254,"description_truncated":false,"requirements":{"experience_years_min":8,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Equity","Flexible schedule","Retirement plans"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Information Security","Quantum Computing Hardware"],"lifecycle":[{"event":"open","at":"2026-11-10T03:35:19Z"}],"visa":[{"country":"US","licensed_sponsor":true,"adverts_offering_sponsorship_24m":0,"sanctioned_now":false,"evidence":"H-1B filings in 12 months: 2","filings_12m":2,"filings_prev_12m":1,"green_card_filings_12m":0,"median_offered_wage_usd":182500,"route":null,"cap_exempt":false,"checked_at":"2026-11-09T07:32:21+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)"],"filings_for_role_12m":0}],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":0,"expected_fill_days":56,"reasons":["conf:1","win:early"],"computed_at":"2026-11-10T05:32:41Z"},"pay":null,"html_url":"https://alion.io/job/diraq-it-security-manager","json_url":"https://alion.io/job/diraq-it-security-manager.json","meta":{"generated_at":"2026-11-10T05:32:41Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":12896,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-11T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":60433},"rest":"https://alion.io/mcp/rest/get_company?id=60433"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fdiraq-it-security-manager"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":2,"usd":0.2},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fdiraq-it-security-manager"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fdiraq-it-security-manager"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/diraq-it-security-manager\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fdiraq-it-security-manager"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":4001215}},{"tool":"search_jobs","arguments":{"company":"diraq.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":4001215},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}