Security & Compliance Manager (Enterprise Security)
Description
Salary: $130,000 – $155,000 per year + great benefits
Keep payday safe (and powering good)
A payslip is someone's mortgage, their groceries and their Friday feeling. We'd like you to help keep it safe.
Kiwi businesses and charities trust us with their people's pay and personal details. You'll make sure that trust is well placed, and make security feel less like a lecture and more like looking after each other.
About Thankyou Payroll
Thankyou Payroll started in a Dunedin garage in 2009 with a radical idea: if every business has to do payroll, let's turn that chore into a force for good. Today we're a social enterprise on our way to becoming fully steward-owned, where our purpose, not private profit, will steer the business. Our profits help fund free payroll for registered charities, and support community and climate-positive work. We're a certified Living Wage Employer, and we build on a bicultural foundation under Te Tiriti o Waitangi.
The role
As our Security & Compliance Manager, you'll make sure we're doing everything we need to do to be secure and compliant as a business, without grinding the business to a halt. You'll look after enterprise security: governance, risk, compliance, identity and access, devices, suppliers and our people. Our DevSecOps Engineer looks after our product platform, and your roles are distinct. If you also know your way around their world, you'll be a great sounding board and can lend a hand when they need it. You'll also give security advice to our Privacy Officer.
This is a new 12-month fixed-term role, created to lead a focused programme of work strengthening our security and compliance. We're ready to go, so you can start as soon as you're able. It can be 0.6–1.0 FTE (22.5–37.5 hours a week). We'd love 0.8 FTE (30 hours a week), but we're happy to talk about what works for you. You'll be based in our Wellington office at least three days a week.
What you'll be doing
Setting our security strategy and roadmap, running the risk register, and giving leadership straight-talking advice on what matters most.
Leading our work against frameworks and obligations like ISO/IEC 27001, the Privacy Act 2020 and Inland Revenue's requirements for software providers, and getting us audit-ready.
Answering customer security questionnaires, and helping us talk plainly about how we protect data.
Owning identity, single sign-on and access across our corporate tools, setting secure baselines for devices and SaaS, and keeping track of where our data goes with suppliers.
Providing the security view in privacy impact assessments for new features, suppliers and AI tools.
Looking after the security and IT recovery parts of our business continuity plans, and being a sounding board for our DevSecOps Engineer when they need one.
Bringing security expertise to our incident response, and helping run post-incident reviews. This is occasionally needed outside normal hours, and we'll agree with you how that works.
Running practical security training and phishing exercises, and setting sensible guardrails for how we use AI tools and agents.
You'll need
Experience owning security outcomes for an organisation, ideally running a security programme in a business that handles sensitive personal or financial data.
Hands-on experience with a framework such as ISO/IEC 27001, SOC 2 or NIST CSF, including preparing for external audits.
A good understanding of New Zealand privacy obligations.
Bonus points for
Some knowledge of cloud and DevSecOps (AWS or Azure, CI/CD, infrastructure as code), so you can be a sounding board for our DevSecOps Engineer and lend a hand when needed.
Solid working knowledge of identity and access management (SSO, MFA, and tools like Auth0, Okta or Entra ID), endpoint management and SaaS security.
Experience handling security incidents, including making sound calls under pressure.
Experience working with government or regulated partners.
Certifications such as CISSP, CISM or ISO 27001 Lead Implementer.
If you don't tick every box, we'd still love to hear from you. We care more about how you think and what you've achieved than how many years you've done it for.
For the full job description: https://canva.link/83pdljcdkod45tm
Why you'll love it here
Your work protects real people's pay, and every pay we process helps fund good in communities across Aotearoa.
You'll have real autonomy to shape how security works here, with a leadership team that wants to hear your advice.
Flexible hours that fit around your life, and adjustments to how, when or where you work, available from day one.
A team that practises manaakitanga (care and respect) and gets together regularly for social events.
Five weeks of annual leave, which you can take as you accrue it, and 20 days of sick leave a year.
An annual wellness allowance, plus Southern Cross health insurance.
Free public transport for your commute to and from the office.
Free period care products through Hello Period's Bloody Good Workplace programme.
Pay
$130,000 - $155,000 at 1.0 FTE, pro-rated to your hours. Your starting point depends on your skills and experience. Moving up the band is based on your impact, not time served.
How we hire
We'll send you the interview themes 24 to 48 hours beforehand, so you can prepare in a way that suits you.
You'll meet a panel of two or three people, and we'll assess everyone against the same criteria.
You're welcome to bring whānau or a support person, and to open the interview with a karakia or a quiet moment.
Let us know about any adjustments you'd like, such as an accessible venue, an NZSL interpreter, a different interview format or different timing. You don't need to tell us why.
Everyone who applies hears back from us. No ghosting, ever.
Before we make an offer, we check two references, your ID and right to work in New Zealand, and run a Ministry of Justice check. Let us know which name your referees know you by.
Ready to apply?
Send us your CV and a short cover note telling us about a security improvement you're proud of and why it mattered. A short video or another format is fine too. We're reviewing applications as they come in and may close the ad early if we find the right person, so don't wait to apply. You'll need to be living in New Zealand, with the right to work here for the full 12 months. Questions? Get in touch with Nicole at nicole.kennedy@thankyoupayroll.nz.
We warmly welcome applications from Māori and Pasifika people, disabled and neurodivergent people, rainbow and takatāpui people, and people of every age and career path.