Senior Security Engineer (IRAP Program Lead)

• Smartsheet’s expansion into Asia-Pacific government markets depends on mastering two critical compliance frameworks: Australia’s Information Security Registered Assessors Program (IRAP) and Japan’s Information System Security Management and Assessment Program (ISMAP)
• Both are essential gatekeepers for federal/national government adoption in their respective markets
• We’re seeking a Senior Security Engineer II to own both programs end-to-end—managing IRAP assessments and continuous assurance in Australia, and ISMAP registration and compliance in Japan
• You’ll be the authority on APAC government security standards at Smartsheet, the trusted interface with assessors and government agencies, and the architect of compliance processes that keep us ahead of evolving requirements
• This role is critical for capturing high-value government business across the Asia-Pacific region
• Own IRAP (Australia) program strategy and execution: Lead the overall roadmap for obtaining and maintaining IRAP authorizations, including assessment coordination, remediation, and authorization maintenance
• Own ISMAP (Japan) program strategy and execution: Lead registration and compliance for Japan’s government cloud certification program, managing the certification assessment process and maintaining registry status
• Coordinate with regional assessors and government agencies: Manage relationships with ASD-endorsed IRAP assessors (Australia) and JASA-registered ISMAP assessors (Japan). Serve as the primary contact for government agencies and compliance authorities in both regions
• Design and maintain IRAP System Security Plans (SSP) and ISMAP Management Standards documentation: Develop comprehensive compliance documentation that maps Smartsheet’s architecture to both IRAP (ISM control framework) and ISMAP (~1200 controls) requirements
• Manage continuous monitoring and quarterly updates: Operate continuous assurance programs for both frameworks. Track ISM quarterly updates (Australia) and ISMAP framework evolution (Japan). Maintain evidence of ongoing compliance
• Lead POA&M and remediation management: Identify, prioritize, track, and remediate findings from both IRAP and ISMAP assessments. Manage timelines and evidence collection for remediation closure
• Coordinate significant changes and system modifications: Work with product and engineering teams to assess and obtain approval for changes that impact IRAP authorization or ISMAP registration status
• Build evidence libraries and assessment readiness: Design processes for collecting, organizing, and maintaining compliance evidence for both frameworks. Ensure audit trails and traceability from controls to implementation
• Drive automation and efficiency: Identify opportunities to automate compliance workflows, reduce manual effort, and improve evidence collection efficiency while maintaining rigor and auditability across both programs

Benefits

• Lucrative Employee Stock Purchase Program (15% discount)
• 401k Match to help you save for your future (50% of your contribution up to the first 6% of your eligible pay)
• Monthly stipend to support your work and productivity
• Flexible Time Away Program, plus Incidental Sick Leave
• Up to 24 weeks of Parental Leave
• Personal paid Volunteer Day to support our community
• Opportunities for professional growth and development including access to LinkedIn Learning online courses
• Company Funded Perks, including a counseling membership, primary care membership, local retail discounts, and your own personal Smartsheet account
• US employees receive 12 paid holidays per year
• US employees are automatically covered under Smartsheet-sponsored life insurance, short-term, and long-term disability plans
• Teleworking options from any registered location (role specific)
• HSA, 100% employer-paid premiums, or Buy-up medical/vision and dental coverage options for full-time employees
• Equity - Restricted Stock Units (RSUs) with all offers
• Monthly contributions toward your pension
• Mployer-paid Private Medical and Dental, additional cost for family members- This is a specialized, high-impact role for someone with deep expertise in both frameworks and comfort operating within government compliance ecosystems across two distinct cultures and regulatory environments
• Excellent documentation and communication skills: Ability to write clear compliance documentation, develop control narratives, and communicate technical concepts to both Australian and Japanese government audiences
• 5+ years of hands-on experience with government security compliance frameworks, with direct involvement in at least two of: IRAP (Australia), ISMAP (Japan), FedRAMP (US), or equivalent national frameworks
• Deep knowledge of ISMAP: Understanding of ISMAP framework (based on ISO/IEC 27001), ~1200 control requirements, ISMAP-LIU (Low-Impact-Use) variant, and Japanese government procurement context
• Technical foundation in cloud architecture and security: Working knowledge of AWS/Azure/GCP, cloud security controls, infrastructure-as-code, logging, incident response, and compliance-relevant architectures
• Understanding of APAC government compliance contexts: Familiarity with how Australian and Japanese government agencies evaluate security, make risk-based decisions, and maintain ongoing compliance obligations
• A degree in Computer Science, Engineering, or a related field or equivalent practical experience
• Experience with continuous monitoring and evolving framework requirements: Understanding of how to maintain compliance in dynamic regulatory environments where frameworks and standards update regularly
• Legally eligible to work in the U.S. on an ongoing basis
• Deep knowledge of IRAP and ISM: Fluency with Information Security Manual (ISM) control framework, Essential Eight Maturity Model, Protective Security Policy Framework (PSPF), and how controls map to cloud architecture
• Proven experience coordinating with regional assessors: You’ve managed assessments in multiple regulatory environments, worked through assessment findings, and translated recommendations into remediation plans
• Bilingual or multilingual capability (English + Japanese, or English + Australian government context familiarity)
• Professional security certifications: CISSP, CISM, CISA, ISO 27001 Lead Auditor, or equivalent
• Experience with multiple government compliance frameworks (FedRAMP, CMMC, or other national programs)
• Background in cloud service provider compliance or SaaS security in APAC markets