Cyber Grc Analyst

Azooa; Canberra; On-site; AUD 182,000 - 193,000; Full time

Job summary

Azooa is seeking a Senior Cyber Security Governance Analyst to support the Australian Electoral Commission's resilience uplift program. The role focuses on governance, risk and compliance, security documentation, and stakeholder engagement in a high‑assurance government environment.

You will work onsite in Canberra with NV1 clearance required before commencement; 37.5 hours weekly; RFQ closing emphasizes strong evidence of GRC capability and practical government experience.

Qualifications

• Minimum 5 years' experience in related roles.
• Experience delivering cyber security GRC in high‑assurance government environments.
• Knowledge of ISM, PSPF and Essential Eight.
• Demonstrated stakeholder or client engagement to achieve outcomes.

Responsibilities

• Contribute security considerations to solution design.
• Review and develop security requirements for projects.
• Develop executive communications and decision papers.
• Coordinate security assurance processes.
• Coordinate penetration testing activities.
• Develop formal cyber security documentation.
• Support election‑specific cyber security during events.

Skills

Security governance

Risk management

Stakeholder engagement

Security assurance

Executive briefs

Documentation development

Job description

Job Description

Azooa is preparing a response for LH-07441 – Senior Cyber Security Governance Analyst with the Australian Electoral Commission (AEC) and is seeking a suitably qualified cyber security professional for this opportunity.

Overview

The Australian Electoral Commission is seeking a Senior Cyber Security Governance Analyst – APS6 equivalent to support cyber security Governance, Risk and Compliance activities within the AEC's resilience uplift program.

The role reports to AEC Cyber Security and will also support election‑specific cyber security requirements during electoral events.

This is a surge position linked to the delivery of electoral events and requires a consultant who can work confidently across security governance, assurance, executive documentation and stakeholder engagement in a high‑assurance government environment.

Scope / Responsibilities

• Contribute security considerations to solution design
• Review and provide recommendations for the development of security requirements
• Develop communications and documentation for senior executive decision‑making
• Support coordination of security assurance processes
• Support coordination of penetration testing
• Lead the development of formal cyber security documentation
• Support broader cyber security GRC activities within the resilience uplift program
• Provide additional support for election‑specific cyber security requirements during electoral events.
• Knowledge of the Information Security Manual (ISM), Protective Security Policy Framework (PSPF) and Essential Eight
• Demonstrated experience and capability performing a cyber security GRC role
• Demonstrated experience managing stakeholder or client interactions to achieve an outcome
• Minimum 5 years' experience in related roles.

Strong Candidate Profile

• Australian Government cyber security GRC
• Security governance and risk management
• Security requirements development
• IRAP coordination or remediation
• Security assurance
• Formal security documentation
• Executive briefs and decision papers
• Stakeholder and client engagement
• Security risk assessments
• Working within classified Commonwealth environments

Role: Senior Cyber Security Governance Analyst

Experience Level: Senior – APS6 equivalent

Candidate Limit: Maximum 1 candidate per seller

Security Clearance: NV1 required prior to commencement

RFQ Closing: 11:59pm, Friday 28 August 2026 Canberra time

Working Arrangement

The role is full‑time onsite in the ACT.

Temporary work‑from‑home arrangements may be considered on a case‑by‑case basis, but the AEC has confirmed that onsite presence in the ACT is required.

The normal working pattern is 7.5 hours per day, Monday to Friday, equating to 37.5 hours per week.

Additional hours may be required during electoral events or other periods of heightened activity, with 45 hours per week being a notional maximum where operationally required. Extended hours and weekend work may also be required during key event periods.

Clearance Requirements

An active NV1 clearance is required prior to commencement.

Although the original listing states that the candidate must be able to obtain NV1, the AEC subsequently clarified in the RFQ Q&A that candidates must be NV1 cleared before commencing because the role requires access to classified information.

The AEC has also stated that candidates who already possess NV1 are strongly preferred. Candidates without the required clearance during interview may be removed from further consideration.

Azooa recommends structuring the pitch around clear evidence of:

• ISM, PSPF and Essential Eight application
• Hands‑on cyber security GRC delivery
• Security governance and assurance
• IRAP and penetration testing coordination
• Development of formal GRC and security documentation
• Practical outcomes achieved in government or comparable regulated environments

Specific examples with measurable outcomes will generally provide stronger evidence than broad capability statements.

RFQ Relevance

A strong submission should demonstrate more than general cyber security experience.

The AEC is specifically seeking someone with practical Governance, Risk and Compliance capability who can operate across both technical security assurance and senior‑level documentation.

Strong candidates should make their experience visible across:

• Cyber security governance
• Risk and compliance
• Penetration testing assurance
• Security requirements

Given the candidate limit of one, Azooa will be focusing on a strongly aligned profile with active NV1 clearance and clear evidence against all essential criteria.

Rate Guidance

• Azooa recommends bidding around $135/hour PAYG including super or $137/hour + GST via Pty Ltd where commercially workable.
• Azooa recommended value‑for‑money PAYG range: $132–$138/hour including super
• Azooa recommended value‑for‑money Pty Ltd range: $134–$140/hour + GST
• Preferred PAYG target: approximately $135/hour including super
• Preferred Pty Ltd target: approximately $137/hour + GST
• Azooa recommended maximum PAYG rate: $145/hour including super
• Azooa recommended maximum Pty Ltd rate: $147/hour + GST
• Around $132–$138/hour PAYG / $134–$140/hour + GST Pty Ltd: strongest value‑for‑money positioning and potentially a higher chance of winning where the candidate demonstrates strong role fit
• Around $139–$145/hour PAYG / $141–$147/hour + GST Pty Ltd: may still be competitive where supported by strong Australian Government GRC experience, active NV1, IRAP exposure and excellent ISM / PSPF / Essential Eight capability
• Above $145/hour PAYG / $147/hour + GST Pty Ltd: less competitive unless niche cyber security expertise, clearance, domain fit or exceptional Federal Government experience clearly justifies the higher rate

Higher rates may still be considered where niche cyber security skills, clearance, domain fit or strong program relevance outweigh rate competitiveness.

The RFQ itself does not publish a maximum hourly rate, so these figures are Azooa's recommended pricing guidance, not buyer‑set caps.