Contract Security Analyst – External Attack Surface

NCS Australia; Sydney; On-site; AUD 120,000 - 180,000; Full time

Job summary

NCS Australia is seeking a Security Analyst for an initial short-term contract in Sydney, running from October through December 2026, with possible extensions. The role focuses on analyzing external exposure data to build a risk-actionable baseline and to bridge technical discovery with risk governance.

You will consolidate asset data, reconcile ownership, and engage across application, infrastructure, and business teams to prioritize remediation and produce audit-ready documentation for ongoing

Qualifications

• Proven track record as a Security Analyst focusing on External Attack Surface Management (EASM), threat exposure, or vulnerability risk analysis.
• Strong capability to consolidate, query, and de-duplicate large, complex technical datasets from multiple security scanning platforms.
• Deep understanding of enterprise inventory management, asset discovery lifecycle, and threat modeling frameworks.
• Technical knowledge of IP routing, DNS, domain management, SSL/TLS, VPN architectures, and public cloud infrastructure (GCP/AWS/Azure).
• Excellent communication skills to coordinate with technical owners, drive asset attribution, and negotiate remediation actions.
• Sydney-based and available to commence the engagement in October 2026.

Responsibilities

• Analyze large-scale external exposure datasets (IP addresses, domains, subdomains, VPN assets, cloud services, and edge infrastructure) to establish an authoritative external attack surface baseline.
• Consolidate, normalize, and de-duplicate asset discovery data from multiple internal and external discovery engines into a single source of truth.
• Reconcile discovered external assets against internal registers to identify ownership gaps, rogue non-production environments, and unmanaged services.
• Collaborate across application, infrastructure, and business teams to validate technical relationships, business criticality, and operational status.
• Evaluate findings to identify systemic control gaps, orphaned assets, and security risks—prioritizing remediation based on threat posture, business impact, and effort.
• Define clear treatment recommendations, including remediation actions, ownership assignment, risk acceptance, or asset decommissioning.
• Maintain audit-ready records of findings, decision rationale, ownership records, and evidence to support handover to ongoing operational teams.
• Deliver clear reporting and insights on exposure trends, remediation progress, and systemic control issues for senior cybersecurity leadership.

Skills

EASM experience

Data reconciliation

Asset governance

Network security

Stakeholder influence

Sydney availability

Job description

NCS Australia is seeking a Security Analyst for an initial short-term contract in Sydney, running from October through December 2026, with possible extensions. The role focuses on analyzing external exposure data to build a risk-actionable baseline and to bridge technical discovery with risk governance.

You will consolidate asset data, reconcile ownership, and engage across application, infrastructure, and business teams to prioritize remediation and produce audit-ready documentation for ongoing