Information Security Manager

Australian Financial Complaints Authority Limited; City of Melbourne; Hybrid; AUD 120,000 - 180,000; Full time

Benefits offered by this job

Gold AWEI Accreditation 2025

Accredited Family Friendly Workplace

Hybrid working

Additional and inclusive leave options

Job summary

Australian Financial Complaints Authority (AFCA) in Melbourne seeks an experienced Information Security Manager to design and implement information security, governance and information management controls for the Scams Prevention Framework. You will collaborate across Legal, Privacy, Data Governance and Technology to secure sensitive scams-related information from day one.

Reporting to the CISO, you will assess capabilities, identify gaps, and develop uplift plans while supporting secure

Qualifications

• Experience in information security, governance, cyber risk, security assurance or secure handling.
• Experience assessing security controls and practical uplift activities.
• Understanding of sensitive information handling, classification, access control and lifecycle management.
• Experience coordinating security requirements across multiple capability owners without duplication.
• Experience in information management: governance, records, lifecycle, metadata, retention and disposal.
• Ability to establish enterprise information management within governance structures.
• Strong written communication for procedures and exec summaries.
• Sound judgement and discretion with sensitive information.
• Ability to work in evolving program environments.
• Familiarity with MS 365 / SharePoint, DLP, access controls, audit logging and doc-management patterns.

Responsibilities

• Assess current information security and information management capabilities across the Scams EDR Program.
• Identify gaps in systems, processes, controls and information handling practices.
• Develop and deliver security uplift recommendations and implementation roadmaps.
• Support secure information handling, classification and lifecycle management practices.
• Partner with Privacy, Data Governance and Risk teams to strengthen security controls.
• Provide advice on document classification, access controls, secure sharing and governance.
• Support assurance activities, control reviews and audits.
• Create security assessments, guidance and executive reports.
• Drive awareness and capability uplift across teams handling sensitive information.

Skills

Info security

Info governance

Cyber risk

Security assurance

Document classification

Access control

Info lifecycle

Cross-functional

Written comms

Tools

Microsoft 365

SharePoint

DLP

Audit logging

Job description

Australian Financial Complaints Authority – Melbourne VIC

Make a real impact at AFCA. Where fairness drives every decision. Help us deliver world‑class, independent complaints resolution for Australians. As a not‑for‑profit and progressive financial ombudsman, we’re championing positive change. Achieving our purpose takes progressive thinking, accountability and resilience. At AFCA, our inclusive leadership values every voice. We offer our people flexible work options, thoughtful benefits and opportunities to deepen expertise. Flourish in a diverse, caring culture. Feel the difference of belonging to an organisation intentionally designed to put people first.

Company Description

Fairness feels good

Make a real impact at AFCA. Where fairness drives every decision. Help us deliver world‑class, independent complaints resolution for Australians. As a not‑for‑profit and progressive financial ombudsman, we’re championing positive change. Achieving our purpose takes progressive thinking, accountability and resilience. At AFCA, our inclusive leadership values every voice. We offer our people flexible work options, thoughtful benefits and opportunities to deepen expertise. Flourish in a diverse, caring culture. Feel the difference of belonging to an organisation intentionally designed to put people first.

Job Description

Help build the security foundations of Australia's new scams dispute resolution framework.

At AFCA, we're preparing to deliver a world‑first external dispute resolution scheme under the Scams Prevention Framework (SPF), providing Australians with an independent pathway to resolve scam‑related complaints across banking, telecommunications and digital platforms.

We're looking for an experienced Information Security Managerto help design and implement the information security, governance and information management controls that will support this significant new function. This role sits at the intersection of cyber security, information governance, privacy, risk and business transformation, ensuring highly sensitive information is managed securely and responsibly from day one.

The opportunity

Reporting to the Chief Information Security Officer (CISO), you'll play a key role in assessing AFCA's capability to securely receive, handle, store, classify and share sensitive scams‑related information.

Working across Technology, Legal, Risk, Privacy, Data Governance and business stakeholders, you'll identify risks and capability gaps, develop practical uplift recommendations and help implement secure operating practices that support both the Scams EDR Program and AFCA's broader information management maturity.

This is a rare opportunity to influence how a new national scheme manages sensitive information while helping shape security and governance practices across a rapidly evolving environment.

This role is a 12-month max‑term contract initially What you'll be doing

• Assess current information security and information management capabilities across the Scams EDR Program.
• Identify gaps in systems, processes, controls and information handling practices.
• Develop and deliver security uplift recommendations and implementation roadmaps.
• Support the design of secure information handling, classification and information lifecycle management practices.
• Partner with Privacy, Data Governance, Records Management, Technology Governance and Risk teams to strengthen security controls.
• Provide practical advice on document classification, access controls, secure information sharing and information governance.
• Support assurance activities, control reviews, audits and evidence gathering.
• Create security assessments, guidance materials, procedures and executive‑level reports.
• Drive awareness and capability uplift across teams handling sensitive scams‑related information.

Qualifications

Essential

• Demonstrated experience in information security, information governance, cyber risk, security assurance or secure information handling.
• Experience assessing security controls and recommending practical uplift activities.
• Strong understanding of sensitive information handling, document classification, enterprise data classification, access control and secure information lifecycle management.
• Experience coordinating security requirements across multiple capability owners (e.g., data governance, IAM, privacy, records management, platform teams) without duplicating those capabilities.
• Demonstrated experience in information management, including information governance, records and document management, information lifecycle management, metadata, retention and disposal.
• Experience assessing information management practices and implementing practical improvements across business and technology functions.
• Ability to establish and support enterprise information management capability while working within existing governance and accountability structures.
• Strong written communication skills, including the ability to prepare clear procedures, assessment reports and executive‑level summaries.
• Sound judgement, discretion and integrity when handling sensitive, confidential or restricted information.
• Ability to work in a developing program environment where requirements may evolve.
• Familiarity with Microsoft 365 / SharePoint, DLP, access control, audit logging and document‑management patterns.

Desirable

• Experience in government, regulatory, intelligence, law enforcement, national security, financial crime, cyber security or critical infrastructure environments.
• Experience with enterprise data classification tooling, information governance platforms or DLP implementation.
• Familiarity with Australian Government protective security expectations, classified information handling or secure information‑sharing arrangements.
• Relevant certifications or qualifications in information security, cyber security, risk, governance, audit, privacy, protective security or technology.

Additional Information

• Gold AWEI Accreditation 2025 – Recognised for LGBTQ+ workplace inclusion.
• Accredited Family Friendly Workplace – Supporting work‑life balance and inclusivity.
• Hybrid working – Flexible arrangements with two days a week in our modernoffices designed for collaboration and wellbeing.
• Additional and inclusive leave options – Flexible public holidays, gender affirmation leave, women’s health leave, and bonus paid time off over the end of year holiday period.

We welcome applications from people of all backgrounds, cultures, abilities, sexual orientations, and gender identities. If you require any accessibility support during the recruitment process, please reach out to our team at *******@afca.org.au.

About AFCA

The Australian Financial Complaints Authority (AFCA) was established in 2018 as a private not‑for‑profit ombudsman service providing free, fair and independent help with financial disputes. The original team has grown to over 1600 dedicated professionals. Since 2018, AFCA has received more than 634,000 complaints, helping to secure $2.1 billion in compensation for consumers.

AFCA is a 2026 Circle Back Initiative Employer - we are committed to responding to every applicant.