Platform Security Operations Manager

AI FactoryOS Operations 

AI FactoryOS is Firmus' proprietary operating system for the AI Factory. It governs GPU telemetry, cooling, power and grid interaction as one integrated layer, so that every Firmus site can be optimised and monitored as a single system. 

AI FactoryOS Operations runs that platform in production and owns the 24/7 reliability of AI FactoryOS, Firmus AI Cloud and the platforms built on them, together with the service levels the estate is measured against. 

The remit is an engineering one. The function builds the guarded automation, remediation and operational tooling that turn manual response into a software-defined capability, and builds and operates the shared services the estate's own operation depends on. The function works closely with the engineering teams that build the platform, supplying the production evidence that shapes what they fix and what they build next. 

Platform Security Operations Manager 

Location : Sydney or Melbourne or Singapore with travel to Australian AI Factory sites as required. 

Role Summary 

Firmus runs large-scale, state-of-the-art AI infrastructure built on the latest generation of GPU rack-scale systems and operated as one estate to power the next generation of AI innovation. The Platform Security Operations Manager leads the Platform Security team and is the manager of the AI Factory's Computer Security Incident Response Team (CSIRT): the team that detects, responds to and recovers from security incidents across AI FactoryOS, Firmus AI Cloud, the platforms built on them and the tenant workloads they carry, and that operates the security controls which keep the AI Factory defensible as it grows.  

This is a hands-on security leadership role. The role manages the AI Factory's security incident response capability: the 24/7 security on-call roster, the incident response plan and playbooks, the exercises that prove they work, and the coordination with incident command and with Cyber Security and Operations leadership when an incident is live. It also manages the operational security the team delivers in production: runtime detection and enforcement, the security gates in the delivery pipeline, the security content of the multi-tenant Kubernetes estate, the security exception register and the independent monitoring of privileged activity. 

Key Responsibilities 

• Lead and manage the Platform Security team, including hiring, onboarding, performance, development and wellbeing across regions. 

• Manage the AI Factory's CSIRT and its 24/7 security on-call roster, so the team is ready to respond at any hour. 

• Manage the AI Factory security incident response plan: severity classification aligned to the function's severity model, and clear escalation paths from the operations and engineering teams. 

• Lead the security response during live incidents: direct triage, containment, eradication and recovery, and keep the incident commander and leadership informed with clear and accurate security assessments. 

• Manage the security incident playbooks for the AI Factory's main threat scenarios, and run regular exercises and tabletop tests with the incident commanders, the engineering teams and operations leadership. 

• Manage evidence handling and chain of custody for security incidents, work with Cyber Security leadership to bring in external forensics support when needed, and keep Cyber Security and Operations leadership supplied with the facts, timeline and recommendations they need during and after an incident. 

• Lead security post-incident reviews and drive the resulting fixes to closure through problem management and the engineering backlogs, and work with vendor security teams on faults and vulnerabilities in the products the AI Factory uses. 

• Track vulnerabilities and threat intelligence relevant to GPU infrastructure, Kubernetes, the identity stack and the products and vendors the AI Factory uses, assess what the AI Factory must act on, and agree priorities and timeframes with the teams that apply the fix. 

• Manage the operational security standard the team delivers for the AI Factory: runtime detection and enforcement, the security gates in the delivery pipeline, the admission, workload identity and network policy content of the multi-tenant Kubernetes estate, and the security acceptance requirements a release has to meet. 

• Manage the security exception process and register, with owners, time limits and compensating controls, and manage the independent monitoring of privileged activity across the estate, keeping the separation between the team that builds access and the team that monitors it. 

• Provide the security evidence the team's controls produce for audit and customer due diligence, and turn findings from incidents and testing into clear engineering requirements for the platform and infrastructure teams. 

• Keep the team's detection, evidence, forensics and incident response tooling fit for purpose, and keep detection coverage growing with the AI Factory. 

Skills & Experience 

Required Skills 

• Significant experience leading a CSIRT in a 24/7 production environment, including owning the incident response plan, playbooks and exercises, and directing the response to security incidents from containment decisions and evidence handling through to post-incident review. 

• A hands-on technical security background in large-scale on-premises and self-hosted infrastructure, covering bare-metal servers, Linux, Kubernetes, network security, identity and privileged access, and runtime detection, strong enough to direct senior engineers during an incident and judge the quality of their findings. 

• Experience operating security controls under ISO 27001, SOC 2 or NIST frameworks and producing the evidence that audits and customer due diligence require. 

• Clear communication and judgement under pressure, able to brief security and operations leadership during an incident, say what is known and not yet known, and make a containment call with incomplete information. 

• Experience with security monitoring, detection and case management tooling (for example SIEM platforms, eBPF-based runtime tools such as Falco or Tetragon, and Jira Service Management or ServiceNow). 

Preferred Experience 

• Experience securing self-hosted, multi-tenant GPU or HPC infrastructure and AI workloads. 

• Experience in a multi-tenant service provider, cloud or colocation environment with contractual security obligations. 

• Experience with digital forensics on bare-metal Linux and container environments, and with working alongside external forensics specialists. 

• Experience with incident response frameworks such as NIST SP 800-61 and the FIRST CSIRT services framework. 

• Relevant certification (for example GCIH, GCFA, CISSP, CISM, or a Kubernetes security credential). 

• A Bachelor's degree in computer science, engineering, cyber security or a related discipline, or an equivalent combination of relevant experience and training. 

Expected Outcomes 

• The incident response plan and 24/7 security on-call roster in place and published within the first quarter, with cover across regions. 

• Security incident playbooks in place for the main threat scenarios, exercised at least quarterly, and executable by any engineer on the roster. 

• Security incidents contained and resolved within agreed targets, working with incident command, with evidence preserved under chain of custody and post-incident actions closed by their agreed dates. 

• Security incident severity levels mapped to the function's severity model, with escalation to Cyber Security and Operations leadership agreed before it is needed. 

• Runtime detection covering the AI Factory, with an alert set that stays actionable as the estate grows, and detection gaps found in exercises or incidents closed. 
• Production releases meeting the security acceptance requirements, with any exceptions time-bound and tracked. 
• Security evidence produced through normal operation and accepted at first pass in audit and customer due diligence. 

On-call: The function runs 24/7. First-line monitoring and first response sit with the operations centre. This role is the escalation point for the security on-call roster and leads the security response to major incidents under the duty incident commander. 

Reporting to: Reports to the Head of AI FactoryOS Operations, working under broad direction with a high degree of autonomy. This role leads a team of 5 to 10 security engineers. 

Employment Basis 

Full-time 

Diversity 

At Firmus, we are committed to building a diverse and inclusive workplace. We encourage applications  
from candidates of all backgrounds who are passionate about creating a more sustainable future  
through innovative engineering solutions. 

Join us in our mission to revolutionize the AI industry through sustainable practices and  
cutting-edge engineering. Apply now to be part of shaping the future of sustainable AI infrastructure.