Senior Manager, Identity and Access Management in Sydney

ASX: Powering Australia's financial markets

Why join the ASX?

When you join ASX, you're joining a company with a strong purpose - to power a stronger economic future by enabling a fair and dynamic marketplace for all.

In your new role, you'll be part of a leading global securities exchange with a strong brand. We are known for being a trusted market operator and an exciting data hub.

We are more than a securities exchange!

The ASX team brings together talented people from a diverse range of disciplines.

We run critical market infrastructure, with 1 in 3 people employed within technology.

Yet we have a unique complexity of roles across a range of disciplines such as operations, program delivery, financial products, investor engagement, risk and compliance.

We're proud to foster a workplace where diversity is celebrated and inclusion is part of our everyday culture.

Our employee-led networks champion LGBTIQ+ inclusion, promote gender equality, accessibility and wellbeing, inspire giving and volunteering, and celebrate cultural and religious events, creating a sense of belonging for all.

As an AWEI Bronze employer and member of the Champions of Change Coalition for gender equality, we're committed to a fair and inclusive workplace where everyone can thrive.

Your Team

The Cyber Security team protects ASX's systems, data and critical services through cyber governance, risk management, security engineering, identity security and threat response.

The Identity Security team operates identity as a primary enterprise security control across workforce, privileged, customer, machine and emerging identities.

It enables trusted access to ASX systems, platforms and digital services while reducing identity-related cyber risk and supporting the resilience of critical market infrastructure.

• Your responsibilities
• Lead and transform the enterprise Identity Security function, setting strategy and overseeing the design, delivery, assurance and operation of identity capabilities.

Provide strategic, technical and people leadership that strengthens access controls, improves business and customer outcomes, embeds cyber resilience and shifts the function from operational service delivery towards proactive identity risk management and measurable control effectiveness.

• Set and deliver the enterprise identity security strategy, roadmap, architecture and operating model, aligned with ASX's cyber strategy, risk appetite, technology priorities and critical‑infrastructure obligations.
• Own five integrated capability domains: identity governance and administration; privileged identity security; enterprise identity and authentication; customer identity and digital trust; and machine, workload and emerging identity security.
• Lead identity governance and administration across the full lifecycle, including joiner, mover and leaver processes, access requests, approvals, provisioning, entitlement governance, segregation of duties, role and attribute-based access, recertification, contractor lifecycle, and orphaned or dormant identities.
• Oversee the operating effectiveness of lifecycle controls and use automation to improve control reliability, timeliness, scalability and user experience.
• Lead privileged identity security across infrastructure, databases, cloud, Saa S, Entra roles, Dev Ops, emergency access, service identities, credentials and secrets.

Minimise standing privilege, use Just‑In‑Time and Just‑Enough Administration where appropriate, and manage standing access as an approved exception.

• Define and enforce enterprise standards for authentication, authorisation, federation, single sign‑on, multi‑factor authentication, Conditional Access and least privilege.

Progress access towards risk‑aware and adaptive controls based on identity risk, privilege, device posture and service criticality.

• Lead customer identity and digital trust, setting direction for secure, resilient and efficient authentication, authorisation, federation, credential management and identity lifecycle services for customers, market participants and digital channels.
• Establish and govern machine, workload and emerging identity security, including service and application accounts, cloud workload identities, API credentials, certificates, cryptographic keys, automation identities, secrets and AI agent identities.

Require named ownership, approved purpose, least privilege, managed credential lifecycle, monitoring and expiry or review.

• Ensure identity platforms and services are secure, resilient, scalable and supported by effective service management, patching, monitoring, disaster recovery, incident response and workforce continuity.

Maintain tested capability to operate priority services during technology disruption, loss of remote access or a material cyber incident.

• Preserve and strengthen identity assurance by owning control design and operat
• #J-18808-Ljbffr