Cyber Security Manager

Profectus; Canberra; On-site; AUD 180,000 - 240,000; Full time

Job summary

Profectus is seeking an experienced Cyber Uplift Program Manager to shape and drive a cyber security uplift for an essential services provider. You will develop strategy, roadmaps and business cases, then manage the program across IT and OT environments to maturity and regulatory alignment.

You will run investment-ready case development, prioritise work based on risk, and lead governance through executives and boards.

Qualifications

• Proven experience delivering cyber security uplift, compliance or resilience programs.
• Experience shaping enterprise cyber security strategy and roadmaps.
• Ability to develop costed, multi year roadmaps with sequencing and dependencies.
• Experience building investment cases with options, benefits, costs and risk analyses.
• Familiarity with ISO 27001, NIST CSF, Essential Eight, ISM or PSPF in uplift settings.
• Strong business writing and presentation skills across reports and roadmaps.

Responsibilities

• Develop and refine enterprise cyber security strategy for IT and OT environments.
• Assess current state against security standards and obligations; define a maturity path.
• Prioritize work using risk-based approaches to address highest exposure.
• Create a costed, multi year uplift roadmap with sequencing and governance.
• Write investment-ready business cases including options analysis and costings.
• Lead workshops with business, IT and OT stakeholders to gather requirements.
• Prepare program briefs and board-ready papers.
• Manage delivery of uplift projects within scope, schedule, budget and reporting.
• Provide guidance to architecture and operations as solutions move into implementation.
• Establish structures to sustain the uplift after program closure.
• Contribute SME input on Microsoft security technologies, SEOs, MFA, IAM and network security.

Skills

Cyber strategy

Roadmap planning

Stakeholder mgmt

Business case writing

Workshop facilitation

ISO 27001/NIST knowledge

OT/IT risk

Executive comms

Project management

Consulting/advisory

Tools

Microsoft security technologies

Job description

Profectus is seeking an experienced Cyber Uplift Program Manager to shape and drive a cyber security uplift program for an essential services provider. You will develop the cyber security strategy, roadmap and business cases that define the program, then manage delivery of the work that follows. The program spans corporate IT and operational technology environments. You will assess current maturity against recognised security standards and regulatory obligations, set a realistic and costed path forward, secure executive and Board support for the investment, and run the projects that deliver it. This suits someone who takes a risk based view of cyber security, can translate obligations into practical work, and is credible with technical teams and executives alike.

Key Responsibilities

• Develop and refine the enterprise cyber security strategy that sets the program direction across IT and operational technology environments
• Assess current state against relevant security standards and regulatory obligations and define a realistic path to the required maturity
• Take a risk based approach to prioritisation so program effort is directed where the exposure sits
• Build and maintain the prioritised, costed, multi year uplift roadmap covering sequencing, dependencies and delivery governance
• Write investment ready business cases including options analysis, benefits, costs, risks and delivery approach
• Run workshops with business, IT and operational technology stakeholders to gather requirements, test findings and build agreement
• Prepare program briefs, papers and reports that stand up to executive and Board scrutiny
• Manage delivery of the cyber uplift projects within the program, including scope, schedule, budget and reporting
• Provide practical guidance to architecture and operations teams as solutions move into implementation
• Establish the structures and processes needed to sustain the uplift once the program closes
• Provide subject matter input on Microsoft security technologies, standard operating environment uplift, MFA and identity and access management, and network security including segmentation, gateways and monitoring

Required Experience

• Demonstrated experience delivering cyber security uplift, compliance or resilience projects and programs
• Experience contributing to or leading enterprise cyber security strategy
• Experience developing costed, multi year cyber roadmaps with clear sequencing and dependencies
• Business case development including options analysis, benefits, CapEx and OpEx modelling and risk analysis
• Working knowledge of at least two of ISO 27001, NIST CSF, Essential Eight, ISM and PSPF, applied in a practical assessment or uplift setting
• Strong business writing skills across business cases, assessment reports, recommendations and roadmaps
• Facilitation and workshop skills, with the ability to run a room and land an outcome
• Stakeholder engagement at all levels, from executive leadership through to technical analysts and non technical business owners
• Project or program management experience covering planning, reporting, budget and resource management
• Business requirements analysis and the ability to turn ambiguity into a defined scope of work
• Knowledge of Microsoft security technologies, standard operating environment uplift, MFA and identity and access management, and network security
• Experience presenting to executive committees and boards, including securing investment approvals
• Exposure to operational technology security risk, including segmentation of OT networks
• Consulting or advisory background
• Experience in critical infrastructure, utilities, energy, water or health environments
• Familiarity with the Security of Critical Infrastructure Act and associated obligations
• Experience developing cyber risk methodologies, business criticality models or target operating models
• Experience building cyber awareness and training programs

Working Arrangements

Why Profectus

Profectus partners with clients across essential services, infrastructure and industry to deliver work that matters. We take pride in matching skilled people to roles where they can do their best work, and we back our consultants with genuine support throughout every engagement. Join a team that values quality, integrity and long-term relationships, and work on projects that make a real difference to the services communities rely on.