Information Security Program Lead

NSW Health; St Leonards; On-site; AUD 150,000 - 190,000; Full time

Benefits offered by this job

Flexible working

Fitness Passport

Novated lease

Salary sacrifice

Job summary

NSW Health is seeking an Information Security Program Lead to develop, implement and maintain the Institute’s information security governance, risk and compliance program. You will advise on security architecture, cyber risk, and compliance obligations to support government policy and industry standards.

The role requires extensive governance/risk work, with frameworks aligned to ISO 27001, NIST and Essential Eight, across multiple security domains.

Qualifications

• Extensive experience leading information security governance, risk and compliance.
• Experience developing, implementing and maintaining security frameworks and policies.
• Strong knowledge across identity, access, network, application, data, cloud security.
• Experience conducting cyber security risk assessments across IT lifecycles.

Responsibilities

• Lead information security governance, risk and compliance initiatives.
• Provide security architecture and risk guidance to support objectives.
• Oversee ISO 27001 certification, audits, and control reviews.
• Develop and maintain frameworks aligned to ISO 27001, NIST and Essential Eight.

Job description

Additional Benefits:

Generous Flexible Working practices, access to Fitness Passport, Novated car leasing arrangement, and Salary sacrificing to Superannuation.

Location:

1 Reserve Road, St Leonards

Applications Close:

Sunday, 11 October 2026 at 11:59PM

The Cancer Institute NSW is committed to creating a diverse and inclusive environment which reflects the community we serve. We encourage candidates from all backgrounds, including Aboriginal and Torres Strait Islander people, LGBTIQA+, neurodiverse individuals, and people with disabilities to apply!

Where you’ll be working

The Cancer Institute NSW is the NSW Government’s cancer control agency, established to lessen the impact of cancer across the state.

Working at the Cancer Institute NSW means joining a team of committed and dedicated staff who are proud to be a part of the Institute’s purpose of overseeing and accelerating the effectiveness of cancer control in NSW.

The Cancer Institute is a collaborative working environment that encourages diversity and inclusion in how we work and the way we work together. Aboriginal and Torres Strait Islander peoples are strongly encouraged to apply. Greater consideration will be given to suitable applicants, in order to improve access to employment and career opportunities (GSE Rule 26).

For your application to be considered

To submit your application, please provide:

• A covering letter addressing the Essential Requirements, as outlined in the Role Description
• A response to the Targeted Questions in your application

About the Opportunity

The Information Security Program Lead is responsible for developing, implementing and maintaining the Institute’s Information Security Governance, Risk & Compliance Program, including security frameworks, policies, standards and controls that reduce cyber security risk to the Institute’s systems, data and digital services.

The role provides specialist advice on security architecture, cyber risk, emerging threats, compliance obligations and security improvements to support business objectives, government policy, industry standards and best practice.

• Extensive experience leading information security governance, risk and compliance activities, including the management of an Information Security Management System, ISO 27001 certification, audit preparation and audit response.
• Demonstrated experience developing, implementing and maintaining security frameworks, standards, policies and processes aligned to government requirements, industry standards and recognised frameworks such as ISO 27001, NIST and the Essential Eight.
• Strong technical security knowledge across core cyber security domains, including identity and access management, network security, application security, data protection, cloud security, security architecture and security operations.
• Demonstrated experience conducting cyber security risk assessments, including threat risk assessments, information security assessments for applications and infrastructure, security control reviews and risk workshops across the IT project lifecycle.

Pre-Screening Questions

• Information security programs often involve more coordination and influence than technical work. Describe an initiative you led where success depended on gaining support from multiple stakeholders with different priorities. Explain:
• How you obtained buy-in
• What resistance you encountered
• How you measured progress
• What you learned about leadership from the experience
• Audits and assurance reviews do not always go to plan. Describe the most challenging audit, review or assurance activity you have been involved in and explain:
• Why it became challenging
• Where you disagreed with auditors, stakeholders or management
• How you worked through those challenges
• What you would do differently if faced with the same situation again
• In your experience, where do organisations most commonly fail when implementing security, risk or compliance frameworks? Describe an example you have personally encountered, how you identified the issue, and what you did to improve the outcome.

Candidate Instructions

Please provide specific examples drawn from your own recent work experience. Include sufficient detail to demonstrate your personal role, thought process, decisions and outcomes. We are interested in understanding what you personally did, why you did it and what you learned from the experience.

Applicants may be asked to discuss their examples in greater detail during interview.

• Find out more about applying for this position
• NSW Health is committed to accessibility and may provide adjustments to the recruitment and interview process as needed, including physical adjustments, interview setup, or scheduling needs.
• This is a permanent position and requires full working rights in Australia (e.g. Australian citizenship/ permanent resident). If you currently hold a temporary visa that allows you to live and work in Australia, you may be eligible for employment opportunities in line with the conditions of your visa.

If interview adjustments are required, please contact [e-mail] at the time the interview invitation is issued, or as soon as reasonably possible. Requests for adjustments will be considered in line with NSW Health requirements.

NSW Health acknowledges the people of the many traditional countries and language groups of New South Wales. It acknowledges the wisdom of Elders past and present, and pays respect to all Aboriginal communities of today.