60019889

Bureau Of Meteorology; Sydney; On-site; AUD 120,000 - 150,000; Full time

Job summary

The Bureau of Meteorology is seeking a Third-party Risk Adviser to strengthen security across the third-party relationships. You will conduct risk assessments for procurement, contracts and service delivery, including FOCI analyses, and provide evidence-based advice on risk treatment and acceptance.

Collaboration with Procurement, Legal, ICT and researchers will embed proportionate security requirements. Operate the third-party risk management register and monitor assurance evidence, while

Responsibilities

• Conduct new, periodic and event-driven third-party security risk assessments across the third-party relationship lifecycle, from early procurement planning and provider selection through contracting, service delivery, change, renewal, completion and termination.
• Conduct FOCI risk assessments for procurement and contract decisions, analysing ownership, control, governance, influence, foreign jurisdiction and data-access considerations, and reassessing risks when developments during the contract period may give rise to new or changed FOCI risks.
• Assess whether proposed third parties, products and services are secure and verifiable and whether identified security risks can be mitigated to a reasonable and acceptable level; document the basis for advice and escalte unacceptable or unquantifiable risks and proposed residual-risk decisions to the appropriate authority.
• Advise procurement teams, contract managers and business owners on proportionate security terms and conditions, including relevant PSPF obligations, subcontractor requirements, security incident notification and cooperation obligations, ongoing assurance, information and resource protections, and completion or termination arrangements.
• Review third-party assurance evidence, including relevant certifications, attestations, security assessments and IRAP assessment reports where applicable, and identify gaps, limitations, risks and required treatments.
• Support contract managers to monitor and review whether specified security controls, terms and conditions are implemented, operated and maintained by contracted providers and subcontractors over the life of the contract, and follow up or escalte non-compliance.
• Manage the third-party risk management register as an accurate and auditable record of third parties, assessments, FOCI considerations, vendor and supply chain risks, risk owners, decisions, residual risks, security treatments, contractual obligations, assurance evidence, review dates and reassessment triggers.
• Monitor agreed security treatments, recommendations and contractual security obligations through to closure; identify overdue, ineffective or changed controls; and coordinate reassessment and adjustment of risks when the provider, service, supply chain, ownership, jurisdiction, threat environment or contract changes.
• Facilitate informed risk discussions and provide clear, practical and impartial advice on provider selection, alternative arrangements, risk treatment, residual risk acceptance, escalation and ongoing assurance, including impacts on other entities or the Australian Government where relevant.
• Build productive relationships across Security, Procurement, Legal, ICT, research and business areas; contribute to consistent third-party risk management practices, templates, guidance and reporting; and work with limited direction while escalating complex, sensitive or unacceptable risks.
• Complying with all Bureau work, health and safety policies and procedures, and taking reasonable care for your own health and safety and that of employees, contractors and visitors who may be affected by your conduct.

Job description

The Third-party Risk Adviser is a security practitioner in the Security Risk, Threat and Assessment team. Reporting to the Security Risk Lead, the role supports the Bureau to identify and address security risks associated with third parties throughout the third-party relationship lifecycle. Third parties may include partners, consultants, vendors, service providers and suppliers engaged through procurement, outsourcing, contracts, partnerships and collaborations, including academic collaborations.

The role conducts new, periodic and event-driven third-party security risk assessments, including vendor and supply chain risk assessments and Foreign Ownership, Control or Influence (FOCI) risk assessments. It analyses jurisdictional, governance, privacy and protective security risks; assesses the source, reliability and integrity of providers and supply chains; and provides evidence-based advice on whether identified risks can be treated to an acceptable level.

The adviser works with procurement teams, contract managers, business owners, project and program areas, researchers, ICT, Legal and other security stakeholders to embed proportionate security requirements into procurement and contractual arrangements. The role maintains the third-party risk management register and monitors security treatments, contractual security obligations, provider compliance and reassessment triggers across the life of an arrangement, including completion or termination.

The Third-party Risk Adviser is a security practitioner in the Security Risk, Threat and Assessment team. Reporting to the Security Risk Lead, the role supports the Bureau to identify and address security risks associated with third parties throughout the third-party relationship lifecycle. Third parties may include partners, consultants, vendors, service providers and suppliers engaged through procurement, outsourcing, contracts, partnerships and collaborations, including academic collaborations.

The role conducts new, periodic and event-driven third-party security risk assessments, including vendor and supply chain risk assessments and Foreign Ownership, Control or Influence (FOCI) risk assessments. It analyses jurisdictional, governance, privacy and protective security risks; assesses the source, reliability and integrity of providers and supply chains; and provides evidence-based advice on whether identified risks can be treated to an acceptable level.

The adviser works with procurement teams, contract managers, business owners, project and program areas, researchers, ICT, Legal and other security stakeholders to embed proportionate security requirements into procurement and contractual arrangements. The role maintains the third-party risk management register and monitors security treatments, contractual security obligations, provider compliance and reassessment triggers across the life of an arrangement, including completion or termination.

The key duties of the position include:

• Conduct new, periodic and event-driven third-party security risk assessments across the third-party relationship lifecycle, from early procurement planning and provider selection through contracting, service delivery, change, renewal, completion and termination.
• Conduct FOCI risk assessments for procurement and contract decisions, analysing ownership, control, governance, influence, foreign jurisdiction and data-access considerations, and reassessing risks when developments during the contract period may give rise to new or changed FOCI risks.
• Assess whether proposed third parties, products and services are secure and verifiable and whether identified security risks can be mitigated to a reasonable and acceptable level; document the basis for advice and escalte unacceptable or unquantifiable risks and proposed residual-risk decisions to the appropriate authority.
• Advise procurement teams, contract managers and business owners on proportionate security terms and conditions, including relevant PSPF obligations, subcontractor requirements, security incident notification and cooperation obligations, ongoing assurance, information and resource protections, and completion or termination arrangements.
• Review third-party assurance evidence, including relevant certifications, attestations, security assessments and IRAP assessment reports where applicable, and identify gaps, limitations, risks and required treatments.
• Support contract managers to monitor and review whether specified security controls, terms and conditions are implemented, operated and maintained by contracted providers and subcontractors over the life of the contract, and follow up or escalte non-compliance.
• Manage the third-party risk management register as an accurate and auditable record of third parties, assessments, FOCI considerations, vendor and supply chain risks, risk owners, decisions, residual risks, security treatments, contractual obligations, assurance evidence, review dates and reassessment triggers.
• Monitor agreed security treatments, recommendations and contractual security obligations through to closure; identify overdue, ineffective or changed controls; and coordinate reassessment and adjustment of risks when the provider, service, supply chain, ownership, jurisdiction, threat environment or contract changes.
• Facilitate informed risk discussions and provide clear, practical and impartial advice on provider selection, alternative arrangements, risk treatment, residual risk acceptance, escalation and ongoing assurance, including impacts on other entities or the Australian Government where relevant.
• Build productive relationships across Security, Procurement, Legal, ICT, research and business areas; contribute to consistent third-party risk management practices, templates, guidance and reporting; and work with limited direction while escalating complex, sensitive or unacceptable risks.
• Complying with all Bureau work, health and safety policies and procedures, and taking reasonable care for your own health and safety and that of employees, contractors and visitors who may be affected by your conduct.

Getting to know the Bureau of Meteorology

The Bureau of Meteorology is one of the few organisations that touches the lives of all Australians and all Australia, every day. The Bureau works across Australia and remote islands, providing services from the Antarctic to beyond the equator, and from the Indian Ocean to the Pacific.We are Australia's national weather, climate and water agency, in the Agriculture, Water and Environment portfolio of the Australian Government, operating under the authority of the Meteorology Act 1955 and the Water Act 2007. We provide data, information, knowledge, insight and wisdom to help Australians prepare and respond to the realities of their natural environment, including droughts, floods, fires, storms, tsunami and tropical cyclones.Our products and services include observations, forecasts, analysis and advice covering Australia's atmosphere, water, oceans and space environments. We undertake focused scientific research in support of our operations and services. Through regular forecasts, warnings, monitoring and advice, we provide one of Australia's most fundamental and widely used public services.We have strong relationships with our customers, partners and stakeholders in Australia, including the Australian Community and the emergency services sectors, all-levels of Government, and focus sectors including aviation, agriculture, energy and resources, national security and water.