IT & Security Manager at Open Point – Fitzroy | Jobyssey

The Opportunity

We are hiring an IT & Security Manager to own two things most companies split: the internal technology our people rely on, and the security and compliance posture our customers assess us on. You will work alongside a counterpart in Canada on IT support coverage, while holding full ownership of security and compliance for Open Point.

This role suits someone who has run IT or information security in a SaaS business and wants complete ownership of the security and compliance function, plus a shared role in internal support.

You will report to the Chief Product & Technology Officer and work closely with the Engineering Manager, Principal Engineer, your Canada-based IT Manager counterpart, and our sales and customer teams. You will be the person a government procurement team's security questions ultimately land with, and the person our executive relies on to know where our real risks sit.

Because this role both operates controls and reports on their effectiveness, we deliberately build in independent checks. Access reviews, control testing, and audit findings are signed off outside the IT function, penetration testing and control assessment are performed by independent third parties, and you report risk directly to the executive. We would rather design this properly than explain it to an auditor later, and we expect you to hold us to it.

Why Join Open Point?

Flexible hybrid working arrangement
Unlimited coffee tab at the local café
Paid birthday leave annually
Professional development reimbursement
Annual wellness reimbursement
One-off home office allowance
Generous paid parental leave options

What You'll Do

IT support (shared with your Canada counterpart)

- Run identity and access management across our SaaS estate, including joiner, mover, and leaver processes that hold up under audit
- Own endpoint management, device compliance, and patching across a distributed workforce, coordinating coverage with your Canada counterpart
- Manage SaaS administration, licensing, and technology spend, with a view on consolidation and cost
- Own internal support, escalation paths, and the tooling that makes both faster, with shared on-call handover across time zones

Security and compliance (owned by this role)

- Own ISO 27001, ISO 9001, and SOC 2 Type II: scope, surveillance audits, recertification, and the annual calendar
- Maintain the ISMS, risk register, policy set, and evidence base as a live system rather than an annual scramble
- Run internal audits, management review, and corrective actions, and manage our certification bodies and external auditors
- Own security questionnaires, RFP security schedules, and privacy impact assessments from customers, and the trust documentation behind them
- Operate and improve the AI assisted workflow used to draft questionnaire responses, and hold accountability for the accuracy of what goes out
- Maintain the enterprise risk register and report on it to the executive and the board
- Own security incident response: the plan, the drills, and the coordination when something real happens
- Provide governance over product security, reviewing that secure development practices, dependency management, vulnerability handling, and cloud configuration standards are followed and effective
- Commission and manage independent penetration testing, and track findings to closure
- Own data residency and support access controls, and make sure public commitments match operational reality
- Run security awareness, phishing simulation, and onboarding training
- Support sales and customer teams in security conversations, including joining customer calls when needed

Our Environment Cloud & Infrastructure:

Azure & AWS, Terraform, CI/CD pipelines Observability: Azure App Services, Datadog, OpenTelemetry Product Stack: .NET (C#), React + TypeScript, MSSQL Identity & Endpoint: [Microsoft Entra ID / Google Workspace], [MDM platform] Compliance & Assurance: ISO 27001, ISO 9001, SOC 2 Type II, [GRC platform] AI Tooling: Claude and AI-assisted workflows across engineering and operations

Skills & Experience

8+ years in IT or information security, ideally in a SaaS or technology business selling to government or regulated sectors

Demonstrated ownership of ISO 27001 and SOC 2 certification cycles, not just participation in them
Strong grasp of identity and access management, endpoint security and cloud security fundamentals in AWS or Azure
Experience responding to customer security assessments, with the judgement to know what to commit to and what to qualify
Able to explain technical risk to a non-technical executive audience and to a sceptical government procurement officer
Comfortable being the accountable owner rather than an escalation point
Nice to Have ISO 27001 Lead Implementer or Lead Auditor, CISSP, CISM or equivalent certification
Experience with privacy regimes across multiple jurisdictions, particularly the Australian Privacy Principles and GDPR
Exposure to ISO 9001 or other quality management systems
Experience in a private equity backed business, or through a due diligence process
Experience supporting a distributed workforce across several time zones
Experience using AI tools to automate compliance evidence, documentation or questionnaire response

What We Value

Collaboration and Teamwork: Successful outcomes are never achieved alone. You need to work well with others and be accountable for your work. We also expect you to communicate often, be honest and take initiative when appropriate. You will be working openly using modern collaborative platforms.

Passion for Learning: You need to love what you do. We expect you to always be motivated, challenge yourself and continuously learn without having to push you into it. This will include learning things outside your area of expertise and making others around you better.

Talent and Courage: We aim to produce great outcomes. When solving problems, we expect creativity and a focus on the end user. We want you to have tough conversations if things are not right and the courage to ask when you don't know.

At Open Point, we believe that diversity drives success. We are an equal opportunity employer that provides a safe and supportive environment where everyone and anyone can grow. If you require any accommodations or adjustments to participate in the recruitment process, please let us know by including your request in your application.

Explore more jobs