ASX: Powering Australia's financial markets

Why join the ASX?

When you join ASX, you're joining a company with a strong purpose - to power a stronger economic future by enabling a fair and dynamic marketplace for all.

In your new role, you'll be part of a leading global securities exchange with a solid brand. We are known for being a trusted market operator and an exciting data hub.

www.asx.com.au/about/careers/a-great-place-to-work

We are more than a securities exchange!

The ASX team brings together talented people from a diverse range of disciplines. We run critical market infrastructure, with 1 in 3 people employed within technology. Yet we have a unique complexity of roles across a range of disciplines such as operations, program delivery, financial products, investor engagement, risk and compliance.

We're proud to foster a workplace where diversity is celebrated and inclusion is part of our everyday culture. Our employee-led networks champion LGBTIQ+ inclusion, promote gender equality, accessibility and wellbeing, inspire giving and volunteering, and celebrate cultural and religious events, creating a sense of belonging for all. As an AWEI Bronze employer and member of the Champions of Change Coalition for gender equality, we're committed to a fair and inclusive workplace where everyone can thrive.

Your Team

The Cyber Architecture and Assurance team provides independent assurance over ASX's cyber control environment, helping protect the integrity, availability and resilience of market-critical services.

The team works across Cyber Security, Technology and business stakeholders to establish assurance standards, govern testing activity, coordinate specialist external providers, drive accountability for remediation,



and provide evidence over the effectiveness of controls across penetration testing, Red/Purple Team coordination, control validation and risk-based security assessment activities.

Coordinate ASX's end-to-end penetration testing program, including annual planning, project-based testing, engagement governance, vendor delivery, reporting, closure and remediation follow-up.

Coordinate Red Team and Purple Team activities, ensuring exercises are appropriately scoped, governed, safely executed and translated into actionable control improvement opportunities.

Own the scope definition and rules of engagement for penetration testing, ensuring coverage is risk-based, complete, agreed by accountable system and project owners, and aligned to system criticality, project risk, technology change and threat exposure.

Manage relationships with external penetration testing providers, ensuring engagements are appropriately planned, governed, delivered and assessed against agreed quality expectations.

Support budget allocation, forecasting and tracking for penetration testing and related assurance activities, including provider spend, planned testing demand and delivery risks.

Drive internal readiness for regular and project-based penetration tests, holding project, system and platform owners accountable for providing testable environments, required access, approved connectivity, stakeholder support, test windows and safe execution constraints.





Establish and manage engagement governance, including readiness criteria, go/no-go decision points, escalation paths, daily status reporting, issue management, SOW coordination and closure criteria.

Act as the central escalation and decision point during live testing, removing blockers, coordinating rapid issue resolution, tracking coverage against agreed scope, and ensuring high or critical findings are communicated promptly.

Hold technology, application, cloud, infrastructure, business and vendor teams accountable for triaging findings, agreeing remediation actions, tracking closure and escalating material risks where obligations are not being met.

Evaluate, pilot and integrate AI-enabled or automated penetration testing capabilities into the broader cyber assurance and security testing strategy.

Communicate testing outcomes, themes, delivery risks and risk insights clearly to technical teams, senior stakeholders and non-technical audiences.

Your experience and qualifications

Must have:

- Background in information security, penetration testing principles, vulnerability assessment and risk-based security assurance.
- Exposure to the delivery lifecycle for security testing or assurance engagements, including planning, scope governance, readiness management, execution oversight, reporting or remediation follow-up.
- Experience working with external security vendors or penetration testing service providers, including delivery coordination, quality review or performance follow-up.
- Ability to translate project, system and control risk into clear testing objectives, rules of engagement, readiness expectations and remediation priorities.
- Exposure to penetration testing across complex

#J-18808-Ljbffr

📌 Penetration Testing Manager (New South Wales)
🏢 ASX
📍 New South Wales