Information Security Manager

Cushman & Wakefield; City of Melbourne; On-site; AUD 140,000 - 210,000; Full time

Job summary

Cushman & Wakefield is seeking an Information Security Manager to lead the Australia ISMS, align with ISO 27001, IRAP and government requirements, and drive audits, risk and compliance across client environments.

The role requires strong stakeholder management, leadership and experience in regulated settings, with Australian citizenship and willingness to operate from Sydney or Melbourne.

Qualifications

• Strong knowledge of ISO 27001, IRAP, and Australian Government ISM.
• Experience in risk management, audit coordination, and compliance within multinational or regulated environments.
• Excellent communication, stakeholder management, and leadership.
• Preferred certifications: CISM, CISSP, ISO 27001 Lead Implementer/Auditor.
• 5–7+ years in IT Risk and/or IT Audit.

Responsibilities

• Own and maintain the Australia ISMS, including documentation and review schedules.
• Manage ISO 27001 audits and implement corrective actions.
• Lead biannual ISMS management reviews and annual internal audits.
• Oversee quarterly control monitoring and maintain compliance and risk registers.
• Coordinate local vendor risk assessments and ensure alignment with global standards.
• Support incident management, BCP planning, and ISMS testing.
• Conduct regular security and physical checks.
• Oversee data retention and deletion in line with regulations.
• Provide quarterly leadership reports and manage ISMS communications.
• Participate in global policy and standard review.

Skills

ISO 27001

IRAP

Stakeholder management

Leadership

Risk assessment

IT policies

IT Audit

CISM

CISSP

ISO 27001 Lead Implementer/Auditor

Tools

GRC tools

Job description

Job Title

Information Security Manager

Job Description Summary

We are seeking an experienced Client IT Security Manager to lead the ongoing management and enhancement of our Information Security Management System (ISMS) in alignment with ISO 27001, IRAP, and Australian Government security requirements. In this key role, you will oversee audits, risk management, compliance activities, and security governance across our client facing environments.

Job Description

Must be an Australian citizen due to account requirements.

Sydney or Melbourne based

Key Responsibilities

ISO 27001 Responsibilities

• Own and maintain the Australia ISMS, including documentation and review schedules.
• Manage ISO 27001 audits and implement corrective actions.
• Lead biannual ISMS management reviews and annual internal audits.
• Oversee quarterly control monitoring and maintain compliance and risk registers.
• Coordinate local vendor risk assessments and ensure alignment with global standards.
• Support incident management, BCP planning, and ISMS testing.
• Conduct regular security and physical checks.
• Oversee data retention and deletion in line with regulations.
• Provide quarterly leadership reports and manage ISMS communications.
• Participate in global policy and standard review.

IRAP Responsibilities

• Define assessment boundaries and scope based on Australian government services.
• Maintain compliance with Authority to Operate (ATO) requirements, assessing risks for any deviations.
• Review documentation and controls per the Australian Government Information Security Manual (ISM).
• Ensure alignment with ASD’s IRAP Common Assessment Framework.
• Develop and update required security artifacts (e.g., System Security Plan, Statement of Applicability, Security Risk Management Plan).
• Oversee technical configuration reviews, evidence collection, and IRAP assessment reporting.
• Document and address residual risks

Additional Responsibilities

• Work with application owners on vulnerability remediation and reporting.
• Manage cyber security incident notification and communication between internal teams and clients.
• Support local IT and service line teams with compliance requirements, client tender submissions, and audit requests.
• Participate in client security audits and support document requests to meet auditor's timeline.

Required Skills & Experience

• Strong knowledge of ISO 27001, IRAP, and Australian Government ISM.
• Experience in risk management, audit coordination, and compliance within multinational or regulated environments.
• Excellent communication, stakeholder management, and leadership.
• Skilled at managing multiple priorities and collaborating across teams.
• Preferred certifications: CISM, CISSP, ISO 27001 Lead Implementer/Auditor.
• Strong team-building and relationship skills, especially during change.
• Ability to align business goals with partners.
• Familiar with risk assessment, IT policies, standards, and training.
• Broad IT expertise (e.g., distributed computing, networks, financial applications, security, business recovery).
• 5–7+ years in IT Risk and/or IT Audit.
• If you’re ready to take ownership of a critical security function and work collaboratively across a global organisation, we’d love to hear from you.

As an equal opportunity employer, Cushman & Wakefield encourages Aboriginal and Torres Strait Islander and female candidates to apply.

Cushman & Wakefield promotes safety at all times.

INCO:

“Cushman & Wakefield”

About Cushman & Wakefield

Cushman & Wakefield (NYSE: CWK) is a global leader in real estate services, leveraging our specialized expertise to deliver innovative solutions and exceptional value to owners and occupiers. With 52,000 employees in nearly 400 offices across 60 countries, we are one of the largest firms in the industry, with more than 100 years of history. In 2023, we generated $9.5 billion in revenue from our core services. To learn more, visit www.careers.cushmanwakefield.com.