ICT Security GRC Specialist

Decipher Bureau; Canberra; On-site; AUD 189,000 - 231,000; Full time

Job summary

Decipher Bureau in Canberra is seeking a senior Defence ICT security professional with NV1/NV2 clearance and a strong background in GRC ICT security. You will own the compliance narrative for Defence programmes and drive long-term stability on critical systems.

The role offers a permanent position on a large Defence program, with ownership of ISM, DSPF and ACSI compliance, including SOPs and A&A documentation. You will interact with Project Engineers, C4ISR leads and Defence security groups.

Qualifications

• 5+ years in IT with a real security bent
• ISM and DSPF knowledge you could recite in your sleep
• Experience within ASD, DDG or CASG moves you up the pile
• Defence ICT security documentation you've authored that landed an actual ATO
• DevSecOps/Agile delivery exposure

Responsibilities

• Own the ISM, DSPF and ACSI compliance story end to end
• Write and maintain SOPs and A&A documentation
• Review what System Integrators and vendors hand over
• Be the go-to person on what compliant means
• Liaise with Defence security groups for guidance and escalation

Skills

NV clearance

Defence ICT security

ISM knowledge

DSPF knowledge

DevSecOps

Job description

Got NV1 or NV2 clearance and a background in Defence GRC ICT security? Spent years getting systems across the ATO line? This ones for you!

• Canberra - $210k inc. super Great Benefits! NV1 - NV2
• Genuine ownership, not a rotating seat on someone elses backlog
• Interesting Projects!

Here’s what’s actually on the table:

• $210k inc. super
• Clearance sponsorship where needed, NV2 upgrade included if you're currently sitting at NV1
• A permanent seat on a long running Defence program, not a six month stopgap
• Genuine ownership of the ICT security documentation piece rather than being one of twenty hands on it

This role exists because Defence programs live and die by their Authority to Operate, and someone has to own the ISM, DSPF and ACSI compliance story end to end. That means writing and maintaining the SOPs and A&A documentation, reviewing what System Integrators and vendors hand over, and being the person Project Engineering Managers and C4ISR leads come to when they need a straight answer on what "compliant" actually means. You'll also be the direct line into Defence security groups when something needs a steer from above your pay grade.

What gets you shortlisted:

• 5+ years in IT with a real security bent, not adjacent experience
• ISM and DSPF knowledge you could recite in your sleep
• Time inside ASD, DDG or CASG, genuinely moves you to the top of the pile
• Defence ICT security documentation you've authored that's landed an actual ATO
• DevSecOps/Agile delivery exposure
• Strategic or Deployed Networks experience is a bonus, not a dealbreaker

Clearance: NV1 minimum, NV2 preferred. And a hard stop worth knowing upfront, this role touches ITAR-controlled tech, so dual citizens of, or anyone with strong ties to, a prescribed tier 1 or tier 2 country can't be considered.