Information Security Program Lead

NSW Health; Sydney; On-site; AUD 140,000 - 190,000; Full time

Benefits offered by this job

Flexible working

Fitness Passport

Novated car lease

Salary sacrificing to Superannuation

Job summary

The Cancer Institute NSW is seeking an Information Security Program Lead to develop, implement and sustain the Institute’s Information Security Governance, Risk & Compliance Program, including security frameworks, policies and controls that reduce cyber security risk.

The role provides specialist advice on security architecture, cyber risk, emerging threats and compliance obligations to support government policy, industry standards and best practice.

Qualifications

• Experience leading information security governance, risk and compliance.
• Experience with ISO 27001, audit prep and audit response.
• Strong knowledge across core cyber security domains (identity, network, data, cloud).
• Ability to coordinate with stakeholders to drive security programs.

Responsibilities

• Lead information security governance, risk and compliance activities.
• Develop and maintain security frameworks, standards, policies and processes.
• Provide specialist advice on security architecture, cyber risk and compliance obligations.
• Support government policy, industry standards and best practice.
• Coordinate audits and assurance activities across IT projects.

Skills

Governance

ISO 27001

NIST

Essential Eight

IAM

Network Security

Application Security

Data Protection

Cloud Security

Security Architecture

Security Operations

Job description

Additional Benefits: Generous Flexible Working practices, access to Fitness Passport, Novated car leasing arrangement, and Salary sacrificing to Superannuation.

Location: 1 Reserve Road, St Leonards

Applications Close: Sunday, 11 October 2026 at 11:59PM

The Cancer Institute NSW is committed to creating a diverse and inclusive environment which reflects the community we serve. We encourage candidates from all backgrounds, including Aboriginal and Torres Strait Islander people, LGBTIQA+, neurodiverse individuals, and people with disabilities to apply!

Where you’ll be working
The Cancer Institute NSW is the NSW Government’s cancer control agency, established to lessen the impact of cancer across the state.

Working at the Cancer Institute NSW means joining a team of committed and dedicated staff who are proud to be a part of the Institute’s purpose of overseeing and accelerating the effectiveness of cancer control in NSW.

The Cancer Institute is a collaborative working environment that encourages diversity and inclusion in how we work and the way we work together. Aboriginal and Torres Strait Islander peoples are strongly encouraged to apply. Greater consideration will be given to suitable applicants, in order to improve access to employment and career opportunities (GSE Rule 26).

About the Opportunity
The Information Security Program Lead is responsible for developing, implementing and maintaining the Institute’s Information Security Governance, Risk & Compliance Program, including security frameworks, policies, standards and controls that reduce cyber security risk to the Institute’s systems, data and digital services.
The role provides specialist advice on security architecture, cyber risk, emerging threats, compliance obligations and security improvements to support business objectives, government policy, industry standards and best practice.

• Extensive experience leading information security governance, risk and compliance activities, including the management of an Information Security Management System, ISO 27001 certification, audit preparation and audit response.
• Demonstrated experience developing, implementing and maintaining security frameworks, standards, policies and processes aligned to government requirements, industry standards and recognised frameworks such as ISO 27001, NIST and the Essential Eight.
• Strong technical security knowledge across core cyber security domains, including identity and access management, network security, application security, data protection, cloud security, security architecture and security operations.
• Demonstrated experience conducting cyber security risk assessments, including threat risk assessments, information security assessments for applications and infrastructure, security control reviews and risk workshops across the IT project lifecycle.
  

• Information security programs often involve more coordination and influence than technical work. Describe an initiative you led where success depended on gaining support from multiple stakeholders with different priorities. Explain:
• How you obtained buy-in
• What resistance you encountered
• How you measured progress
• What you learned about leadership from the experience
• Audits and assurance reviews do not always go to plan. Describe the most challenging audit, review or assurance activity you have been involved in and explain:
• Why it became challenging
• Where you disagreed with auditors, stakeholders or management
• How you worked through those challenges
• What you would do differently if faced with the same situation again
• In your experience, where do organisations most commonly fail when implementing security, risk or compliance frameworks? Describe an example you have personally encountered, how you identified the issue, and what you did to improve the outcome.

• NSW Health is committed to accessibility and may provide adjustments to the recruitment and interview process as needed, including physical adjustments, interview setup, or scheduling needs.
• This is a permanent position and requires full working rights in Australia (e.g. Australian citizenship/ permanent resident). If you currently hold a temporary visa that allows you to live and work in Australia, you may be eligible for employment opportunities in line with the conditions of your visa.