Sr. Security Engineer II – IRAP Program Lead (Remote Eligible)

For over 20 years, Smartsheet has empowered teams to manage work seamlessly and scale solutions smarter. Now, in our most ambitious chapter yet, we are uniting human teams with AI agents. By orchestrating the work agents do best, automating manual tasks and uncovering insights at scale, we create the space for people to focus on what truly matters: judgment, creativity, and big thinking. That is magic at work, and it’s what we show up for every day. Smartsheet's expansion into Asia-Pacific government markets depends on mastering two critical compliance frameworks: Australia's Information Security Registered Assessors Program (IRAP) and Japan's Information System Security Management and Assessment Program (ISMAP). Both are essential gatekeepers for federal/national government adoption in their respective markets. We're seeking a Sr. Security Engineer II to own both programs end-to-end—managing IRAP assessments and continuous assurance in Australia, and ISMAP registration and compliance in Japan. This is a specialized, high-impact role for someone with deep expertise in both frameworks and comfort operating within government compliance ecosystems across two distinct cultures and regulatory environments. You'll be the authority on APAC government security standards at Smartsheet, the trusted interface with assessors and government agencies, and the architect of compliance processes that keep us ahead of evolving requirements. This role is critical for capturing high-value government business across the Asia-Pacific region. You will: Own IRAP (Australia) program strategy and execution: Lead the overall roadmap for obtaining and maintaining IRAP authorizations, including assessment coordination, remediation, and authorization maintenance. Own ISMAP (Japan) program strategy and execution: Lead registration and compliance for Japan's government cloud certification program, managing the certification assessment process and maintaining registry status. Coordinate with regional assessors and government agencies: Manage relationships with ASD-endorsed IRAP assessors (Australia) and JASA-registered ISMAP assessors (Japan). Serve as the primary contact for government agencies and compliance authorities in both regions. Design and maintain IRAP System Security Plans (SSP) and ISMAP Management Standards documentation: Develop comprehensive compliance documentation that maps Smartsheet's architecture to both IRAP (ISM control framework) and ISMAP (~1200 controls) requirements. Manage continuous monitoring and quarterly updates: Operate continuous assurance programs for both frameworks. Track ISM quarterly updates (Australia) and ISMAP framework evolution (Japan). Maintain evidence of ongoing compliance. Lead POA&M and remediation management: Identify, prioritize, track, and remediate findings from both IRAP and ISMAP assessments. Manage timelines and evidence collection for remediation closure. Coordinate significant changes and system modifications: Work with product and engineering teams to assess and obtain approval for changes that impact IRAP authorization or ISMAP registration status. Build evidence libraries and assessment readiness: Design processes for collecting, organizing, and maintaining compliance evidence for both frameworks. Ensure audit trails and traceability from controls to implementation. Drive automation and efficiency: Identify opportunities to automate compliance workflows, reduce manual effort, and improve evidence collection efficiency while maintaining rigor and auditability across both programs. You Have: 5+ years of hands-on experience with government security compliance frameworks, with direct involvement in at least two of: IRAP (Australia), ISMAP (Japan), FedRAMP (US), or equivalent national frameworks. Deep knowledge of IRAP and ISM: Fluency with Information Security Manual (ISM) control framework, Essential Eight Maturity Model, Protective Security Policy Framework (PSPF), and how controls map to cloud archi…