Head of Audit - Security

NAB Careers; Melbourne; On-site; AUD 250,000 - 350,000; Full time

Job summary

National Australia Bank Ltd. in Melbourne, Australia, seeks a Head of Audit Security to lead the strategy and delivery of the security portfolio including cybersecurity, AI security, identity and data protection.

This role will drive high-quality security audits and provide independent assurance across platforms, cloud, data protection, and resilience. You will partner with the three lines of defence and business audit portfolios, shaping risk-based assurance priorities and translating complex

Qualifications

• Broad technical understanding across IAM, cloud and platform security, data protection, vulnerability management, detection and response.
• Sound AI security foundations for LLM and agentic AI threat models.
• Ability to apply NIST AI RMF, MITRE ATLAS and OWASP guidance for AI security.
• Experience in banking/regulatory environments with leadership of multidisciplinary teams.
• Strong knowledge of APRA CPS 234/230, NIST CSF, ISO 27001.
• CISSP or equivalent; additional credentials desirable (CISM, CISA, CCSP).

Responsibilities

• Lead or sponsor complex security and AI security audits.
• Partner with three lines of defence and technology audit portfolios.
• Translate threats into assurance priorities and business outcomes.
• Develop a high-performing, inclusive security audit team.
• Engage regulators and external assurance providers.

Skills

IAM security

Cloud security

Data protection

Vulnerability management

Detection & response

Secure engineering

AI security

Leadership

Regulatory compliance

APRA CPS 234

NIST CSF

MITRE ATLAS

ISO 27001

CISSP

Job description

• Be a trusted adviser, problem-solver and business partner to Audit, Technology, Security, AI and Risk leaders.
• Personally lead or sponsor the most complex and strategically significant security and AI security audits.
• Strategic security leadership with the judgement to translate complex threats into clear assurance priorities and business outcomes.

Our people are customer obsessed. They prioritise the needs and satisfaction of the customer above all else. Our mindset fosters innovation and creates strong, lasting customer relationships as we strive to be the most customer centric company in Australia and New Zealand.

As a Head of Audit Security, you will join the Internal Audit team that’s focused on keeping it simple. Lead the strategy and delivery of Internal Audit’s security portfolio, providing independent assurance and constructive challenge across cybersecurity, identity, cloud security, data protection, platforms and infrastructure, operational resilience, third-party security, AI security and emerging threats.

In this Head of role, you will:

• Deliver high-quality security audits and insights, connecting themes to identify systemic risk and practical risk-reduction opportunities.
• Partner across all three lines of defence and with business audit portfolios; share ownership of security operations and technical resilience coverage with relevant Technology Audit portfolios.
• Assess whether AI systems and agentic solutions have proportionate security-by-design controls, including approved guardrails, model and agent identity, least privilege, secrets management, secure tool use, logging, monitoring, red teaming, incident response and safe shutdown mechanisms.
• Identify emerging risks including AI-enabled attacks, autonomous-agent abuse, identity-based threats, cloud concentration, software and model supply-chain risk, deepfake/social-engineering threats and post-quantum readiness.
• Build a high-performing, inclusive team and maintain networks with regulators, industry peers, external assurance providers and security and AI specialists.

What you will bring:

• Broad technical understanding across IAM, cloud and platform security, data protection, vulnerability management, detection and response, secure engineering, third-party security and resilience.
• Sound AI security foundations across LLM and agentic AI threat models, prompt injection, data leakage, model and API abuse, identity and privileged access for agents, tool and plug-in security, secure RAG, model supply-chain risk, monitoring, kill switches and human oversight.
• Ability to assess AI guardrails across data, model, application and infrastructure layers, drawing on NIST AI RMF, MITRE ATLAS and OWASP guidance for LLM and generative AI security.
• Substantial relevant experience in security, cyber risk, technology risk, consulting or audit within banking, financial services or another highly regulated industry.
• Leadership of multidisciplinary teams and complex assurance, risk or transformation portfolios.
• Working knowledge of APRA CPS 234 and CPS 230, NIST CSF, ISO/IEC 27001 and relevant AI governance and security practices.
• CISSP or an equivalent recognised security certification. Additional cloud, technology, security, AI or audit certifications such as CISM, CISA, CRISC, CCSP, AWS, Azure, GIAC or recognised AI governance/security credentials are desirable.

We respectfully ask candidates to hold any questions until interview process, where we'll discuss the role in detail and answer any questions. This helps to ensure a focussed, efficient and fair application process. The talent acquisition team looks forward to addressing all inquiries at that time if your application progresses.

A diverse and inclusive workplace works better for everyone

We know that our people make us who we are. That's why we have built a culture of equity and respect - where everyone feels valued and appreciated for being their authentic selves. In partnership with our multiple Employee Resource Groups (ERGs) we continue to foster an inclusive environment, where all NAB colleagues' unique backgrounds and identities are understood, respected and celebrated.

We are committed to providing an environment where you can work your way.