Head of Cyber Security

<p class="p1">Hi! We’re hipages, an ASX-listed tech company and Australia’s #1 digital platform connecting households with trusted home improvement businesses. We're on a mission to transform the home improvement industry to build better lives for everyone.<br>With teams across Australia, New Zealand, the Philippines and Vietnam, we work as one team with a shared purpose.</p> <p class="p1">We’re proud to be a certified Great Place to Work and WORK180’s #1 Employer for Women. At hipages, you’ll find real impact, career growth and a workplace where everyone belongs.</p> <p class="p3"><strong>About the role</strong></p> <p class="p4">You'll own security strategy,&nbsp;governance and operations end-to-end: from presenting posture and risk to the Board's Audit&nbsp;&amp; Risk Committee and Tech Working Group, to steering the security platform and its&nbsp;continuous improvement with a small, high-calibre team through an AI-accelerated engineering transformation.</p> <p class="p5"><strong>Why join our Engineering team?</strong></p> <ul class="ul1"> <li class="li6">Hybrid working model</li> <li class="li6">Competitive salary, benefits, and everyday discounts</li> <li class="li6">In-house Talent Development team to prioritise personal and career growth</li> <li class="li6">Cross-functional collaboration</li> <li class="li7">Hands-on learning opportunities and workshops for continuous upskilling</li> </ul> <p class="p5"><strong>How you will add value</strong></p> <ul class="ul1"> <li class="li6">Own the cyber security strategy and roadmap, anchored to NIST CSF 2.0 and OWASP SAMM, and present posture and risk quarterly to the Audit &amp; Risk Committee and periodically to the Tech Working Group.</li> <li class="li6">Own the security platform — cloud, endpoint, identity, network/SSE, WAF and CI/CD vulnerability gates — configuring and governing tooling, delivered through your AppSec lead, IT Operations and SRE.</li> <li class="li6">Lead security incident response including board-level exercises, run vulnerability management end-to-end, and drive secrets management and IAM hygiene with SRE and Platform teams.</li> <li class="li6">Set the security model for AI-assisted engineering and agentic systems: secure-by-default development practices, agent identity and access, agent-tooling governance and shadow-AI visibility.</li> <li class="li6">Own the external IT audit relationship, run the annual penetration testing program, and oversee privacy operations and vendor due diligence alongside Legal.</li> <li class="li7">Lead, coach and grow your Lead Application Security Engineer, building a partnering model across Engineering, SRE and IT Operations that scales security guidance without becoming a bottleneck.</li> </ul> <p class="p5"><strong>About you</strong></p> <ul class="ul1"> <li class="li6">8+ years experience in security, including experience leading a security function or operating as the clear second-in-command of a larger one, ideally within a listed company or similarly governed environment, with working knowledge of Australian privacy law and listed-company security obligations</li> <li class="li6">Proven board/committee reporting capability: You can translate technical posture into risk language for non-technical directors and hold the room on "are we doing enough?"</li> <li class="li6">Strong technical command of cloud security (AWS), application security / secure SDLC, and the modern control stack (CNAPP/CSPM, EDR, SSE, IdP/MDM, WAF, cloud SIEM), able to configure, evaluate and direct these tools</li> <li class="li6">Framework and audit fluency: NIST CSF 2.0 and OWASP SAMM (or equivalents), with experience running external audits (Big-4 ITGC or similar) through to remediation</li> <li class="li6">Credible AI security depth: LLM and agentic threat models, non-human identity, agent-tooling governance — and demonstrated use of AI to multiply a small team's output</li> <li class="li6">A landscape thinker who delivers through others: You synthesise the evolving threat environment into posture, priorities and pragmatic risk trade-offs, leading through a lean team and partner teams with commercial discipline on a flat budget</li> </ul> <p class="p8"><strong>Bonus points for:</strong></p> <ul class="ul1"> <li class="li6">Experience in a product-led technology, SaaS or marketplace/consumer-scale organisation</li> <li class="li6">Multi-geography workforce security (offshore teams and development partners)</li> <li class="li6">Purple teaming / offensive security background</li> <li class="li7">Security certifications (CISSP, CISM, SABSA or similar)</li> </ul> <p class="p3"><strong>Life at hipages</strong></p> <p class="p4">We're more than just a workplace. We're a place where you can be yourself, do great work and grow your career. Recognised as a Great Place to Work, our inclusive, supportive culture helps people thrive.</p> <p class="p4">You'll use the best tools and tech, with real impact on our products and customers. We invest in your development and lead with coaching, not micromanagement – it's why 85% of our team say their leader is great.</p> <p class="p9">And there's more:</p> <ul class="ul1"> <li class="li6">Diverse, collaborative teams that love solving problems</li> <li class="li6">Agile squads, hackathons, off-sites and roadshows</li> <li class="li6">Extra leave for birthdays, volunteering, and more</li> <li class="li6">Healthy snacks, continental breakfast and fresh fruit</li> <li class="li6">Sydney CBD office near Town Hall and Gadigal Stations</li> <li class="li6">Tailored growth support, mentoring and stretch projects</li> <li class="li7">A vibrant social scene - we work hard and have fun doing it</li> </ul> <p class="p3"><strong>We prioritise Diversity</strong></p> <p class="p4">At hipages, innovation and collaboration thrive in diverse and inclusive teams. We don't expect you to know everything - we care more about who you are as a person, a team member, and a leader. We're proud to be endorsed by WORK180 for supporting women's careers and we value diversity across culture, age, gender identity and sexual orientation.</p> <p class="p4">Research shows that men often apply when they meet just 60% of the criteria, while women and minority groups wait until they tick every box. If you think you'd be a great fit - even if you don't meet every requirement - we'd love to hear from you.</p> <p class="p4">We're also a Circle Back Initiative Employer, which means we commit to responding to every applicant.</p> <p class="p4">#LI-JL1 #LI-Hybrid</p> <p class="p9"><iframe src="https://www.youtube.com/embed/ntj8ttXP88s?si=mW6V4YiC8o9BFqpE" width="560" height="314"></iframe>&nbsp;</p>