Cyber Risk Analyst

Triniti; Sydney; Hybrid; AUD 129,000 - 203,000; Full time

Job summary

Triniti is seeking a Cyber Risk Analyst on a five-month contract to support a Federal Government agency’s Third-Party Risk Management program in Sydney. You’ll assess security risks of vendors, research partners and service providers under the Lead Cyber Risk Specialist.

Based in Australia with a work-from-home arrangement, you will review supplier questionnaires, assess controls across access, encryption, backup, vulnerability management and incident response, and produce clear findings with

Qualifications

• Experience conducting third-party security risk assessments with understanding of inherent and residual risk, likelihood and treatment planning.
• Ability to communicate findings clearly to technical and non-technical stakeholders, and manage multiple assessments under direction of a lead.
• Familiarity with PSPF, ISM, ISO 27001, NIST CSF or Essential Eight; knowledge of privacy obligations.

Responsibilities

• Review supplier questionnaires and security documentation.
• Assess controls covering access management, encryption, backup and recovery, vulnerability management, penetration testing and incident response.
• Identify and rate risks, produce clear assessment reports and remediation recommendations.
• Work with business owners and suppliers to agree remediation owners and timeframes.
• Use UpGuard to support assessments and security monitoring and maintain assessment and risk records.
• Contribute to improvements in assessment processes, questionnaires and templates.

Skills

Vendor risk assessment

Stakeholder communication

Security frameworks

Tools

UpGuard

Job description

Triniti is seeking a Cyber Risk Analyst for a five-month contract to support a Federal Government agency’s growing Third-Party Risk Management program. Working under the Lead Cyber Risk Specialist and alongside the Cyber Resilience team, you’ll assess the security risks associated with vendors, research partners and service providers.

The role

You’ll deliver third-party security assessments from vendor intake and risk tiering through to evidence review, documented findings and treatment recommendations. Your responsibilities will include:

• Reviewing supplier questionnaires and supporting security documentation.
• Assessing controls covering access management, encryption, backup and recovery, vulnerability management, penetration testing and incident response.
• Identifying and rating risks, producing clear assessment reports and recommending practical treatments.
• Working with business owners and suppliers to agree remediation owners and timeframes.
• Using UpGuard to support assessments and security monitoring and maintaining assessment and risk records.
• Contributing to improvements in assessment processes, questionnaires and templates.

About you

• Experience conducting third-party, vendor or supplier security risk assessments, supported by a sound understanding of inherent and residual risk, likelihood, consequence and treatment planning.
• Comfortable managing multiple assessments under the direction of a lead, evaluating security evidence and communicating findings clearly to technical and non-technical stakeholders.
• Familiarity with Australian Federal Government security frameworks including PSPF, ISM, ISO 27001, NIST CSF or the Essential Eight would be valuable, alongside relevant cybersecurity certifications and an understanding of privacy obligations.
• Previous UpGuard experience would be useful.
• Preferred location - Sydney or Brisbane, with a work-from-home arrangement.
• Australian Citizens only - existing Baseline security clearance is required, NV1 would be advantageous.