Cyber Security Program Manager (GRC)

Profectus; Canberra; On-site; AUD 150,000 - 210,000; Full time

Job summary

Profectus seeks an experienced Cyber Security Program Manager with a governance, risk and compliance (GRC) focus to uplift cyber maturity. You will assess current maturity, map regulatory obligations, develop risk management processes, and produce roadmaps, business cases and Board reporting to support multi-year uplift.

Requires seven years in cyber security with GRC, assurance or uplift roles. Responsibilities include policy development, cyber governance, risk registers, and stakeholder

Qualifications

• Minimum seven years in cyber security, including GRC, assurance or uplift roles.
• Experience applying ISO 27001, NIST CSF or Essential Eight in practical uplift.
• Ability to develop cyber risk registers and risk reporting.
• Proven track record in policy standards and governance design.
• Experience building costed multi-year cyber roadmaps.
• Experience presenting to executives and boards.

Responsibilities

• Assess current cyber maturity against ISO 27001, NIST CSF and Essential Eight.
• Map regulatory obligations and track the organisation's compliance posture.
• Develop and maintain cyber risk management approaches and risk reporting.
• Develop cyber security policies, standards and governance structures.
• Contribute to strategy and a costed uplift roadmap with business cases.
• Prepare investment-ready business cases with options, costs and benefits.
• Design governance structures including committees and reporting lines.
• Prepare risk and assurance reporting for executives and Board.
• Coordinate audits and track remediation of findings.
• Run workshops with business, IT and OT stakeholders to agree priorities.

Skills

GRC leadership

Cyber risk management

Policy development

Stakeholder engagement

Executive reporting

Business writing

Job description

Profectus is seeking expressions of interest from experienced Cyber Security Program Managers with a governance, risk and compliance (GRC) focus. The work is likely to require assessing current cyber maturity against security standards and regulatory obligations across IT and operational technology (OT) environments, building the cyber risk, policy and compliance structures the organisation needs, and producing the roadmaps, business cases and Board reporting that support a multi-year uplift.

Key Responsibilities

• Assess current state cyber maturity against standards such as ISO 27001, NIST CSF and the Essential Eight
• Map regulatory and compliance obligations and track the organisation’s position against them
• Develop and maintain the cyber risk management approach, risk register and risk reporting
• Develop and update cyber security policies, standards and procedures
• Contribute to the cyber security strategy and the prioritised, costed uplift roadmap
• Write investment-ready business cases, including options analysis, costs, benefits and risks
• Design cyber governance structures, including committees, roles and reporting lines
• Prepare compliance, risk and assurance reporting for executive and Board audiences
• Coordinate internal and external audits and track remediation of findings
• Run workshops with business, IT and OT stakeholders to test findings and agree priorities

Required Experience

• Minimum seven years in cyber security, including GRC, assurance or uplift roles
• Working knowledge of at least two of ISO 27001, NIST CSF and the Essential Eight, applied in a practical assessment or uplift setting
• Cyber risk assessment and risk register management
• Developing cyber security policies, standards and governance structures
• Developing costed, multi-year cyber roadmaps
• Business case development, including options analysis and CapEx and OpEx modelling
• Presenting to executive committees and Boards
• Stakeholder engagement and workshop facilitation at all levels
• Business writing across assessment reports, policies, business cases and Board papers

Desirable Experience

• CISM, CISA, CRISC or ISO 27001 Lead Implementer or Lead Auditor certification
• OT security risk and frameworks such as IEC 62443
• Critical infrastructure environments and the Security of Critical Infrastructure Act
• Developing cyber risk methodologies, business criticality models or target operating models
• Consulting or advisory background, with a record of delivering the work rather than handing over a report

Working Arrangements

• 100% onsite
• Canberra

Why Profectus

Profectus partners with Australian Government agencies to deliver trusted ICT capability across complex delivery programs. We take a long term, relationship driven approach, supporting our people across the full lifecycle of their engagement while contributing to outcomes of national importance.