Head of Information Security & Cyber Resilience

xceltium; Sydney; Hybrid; AUD 180,000 - 250,000; Full time

Benefits offered by this job

Hybrid work up to 50%

Job summary

Xceltium in Sydney, Australia, seeks a Head of Information Security & Cyber Resilience to lead the first-line information security and cyber resilience function. You will report to the CIO, line-manage one analyst, and coordinate with external providers, shaping strategy in a Microsoft-centric environment.

You'll balance strategic oversight with hands-on problem solving, guiding remediation, risk-based decisions, and stakeholder engagement across the business to build a culture of security and

Qualifications

• Experience leading information security and cyber resilience in regulated environments.
• Knowledge of APRA CPS 234 and CPS 230 is highly desirable.
• Ability to set strategy, governance and improvement roadmaps.

Responsibilities

• Lead cyber security strategy, governance and improvement roadmaps.
• Oversee security operations, threat detection and incident response.
• Strengthen first-line controls and coordinate external providers.
• Advance data protection, third-party security and operational resilience.
• Provide security guidance across cloud and technology initiatives.
• Develop the Information Security Analyst and mentor the team.

Skills

Cyber strategy

Governance

Security operations

Risk management

Resilience

Leadership

Tools

Microsoft Defender

Microsoft Sentinel

Purview

Azure

DLP

Job description

Head of Information Security & Cyber Resilience

Our client is an established, APRA-regulated organisation with approximately 150 employees that has invested significantly in strengthening its cyber security capability.

With a NIST-aligned strategy, improved security monitoring and a defined improvement roadmap, the foundations are in place. They're now seeking a Head of Information Security & Cyber Resilience to build on this progress and lead the next stage.

The Opportunity

Reporting to the Chief Information Officer and working alongside the Head of IT, you'll lead the organisation's first-line information security and cyber resilience function, with one direct report (an Information Security Analyst) and support from specialist external providers.

You'll inherit a predominantly Microsoft environment, including Defender, Sentinel, Azure and a managed Security Operations Centre, with further improvements planned across data protection, identity security, governance and operational resilience.

In an organisation of this size, you'll need to move comfortably between strategy and execution. One day you may be advising executives on cyber risk and investment priorities; the next, resolving a technical security issue, reviewing controls or guiding remediation with your team and external providers.

Success will depend on your ability to assess competing risks, establish realistic priorities and implement proportionate security measures that the organisation can sustain.

Equally important is your ability to engage employees and business stakeholders, making cyber security understandable and building a culture where protecting information is everyone's responsibility.

What You'll Be Doing

Your responsibilities will include:

• Leading the cyber security strategy, governance framework and improvement roadmap, aligned with NIST, APRA CPS 234 and CPS 230.
• Overseeing security operations, threat detection, vulnerability management, identity security and incident response.
• Strengthening first-line controls, coordinating independent assurance and driving remediation.
• Progressing data protection, DLP, third-party security and operational resilience initiatives.
• Providing security guidance across cloud, technology transformation and emerging AI initiatives.
• Developing the Information Security Analyst, overseeing external providers and improving security awareness across the business.

About You

We're looking for an experienced information security leader who brings:

• Broad experience across cyber strategy, governance, security operations, risk management and resilience.
• Strong knowledge of APRA CPS 234 and CPS 230, ideally gained within financial services or another highly regulated environment.
• Experience developing security strategies and delivering realistic, prioritised improvement plans.
• Sound technical knowledge of Microsoft security technologies, cloud security, identity management and security monitoring.
• Commercial judgement to balance security risks, regulatory obligations, costs and business requirements.
• Strong communication and leadership skills, with the ability to influence executives, engage employees and develop others.

Experience with Microsoft Defender, Sentinel, Purview, Azure, DLP and frameworks such as NIST CSF or ISO 27001 would be advantageous. Certifications such as CISSP, CISM or CISA are highly regarded.

Whether you're stepping into your first Head of role or bringing established leadership experience, you'll be comfortable operating in a smaller organisation where strategic ownership, technical involvement and practical delivery go hand in hand.

Working Arrangements

This is a permanent, full-time opportunity based in Sydney CBD, offering a competitive remuneration package commensurate with experience and up to 50% working from home.