IT Security Consultant - Assurance

Minter Ellison; City of Brisbane; On-site; AUD 90,000 - 130,000; Full time

Job summary

MinterEllison in Brisbane seeks an IT Security Consultant to deliver technical security risk analysis and assurance across the firm’s technology environment. The role spans threat and risk assessments, security architecture reviews, and client questionnaires, reporting to the IT Security GRC Manager.

You will collaborate with IT Architecture, IT Operations, and providers to embed security by design and support ISO27001 and related standards across the organisation.

Qualifications

• At least 2 years in information security or IT risk.
• Experience conducting threat and risk assessments using recognised methodologies (e.g. STRIDE, OCTAVE, NIST RMF).
• Familiarity with security architectures including cloud (Azure/M365) and hybrid infrastructure.

Responsibilities

• Conduct threat and risk assessments for systems, applications, and AI solutions with prioritised remediation.
• Perform security architecture reviews against MinterEllison standards and frameworks.
• Provide security input into IT projects to ensure security by design.

Skills

Threat assessment

Risk analysis

Security architecture

Cloud security

Vulnerability management

Audit coordination

Executive reporting

Security certifications

Tools

Qualys

Tenable

CrowdStrike

Job description

Select how often (in days) to receive an alert:

MinterEllison is one of Australia’s largest independent law and consulting firms. With a heritage of almost 200 years, we are known for our excellence, and our authentic and enduring relationships with our clients, our people and our communities. Clients seek out MinterEllison to help them solve complex problems every day. We do this by our full-service legal offering and complementary consulting offering.

We offer opportunities to work on industry-leading mandates for top-tier clients, while being part of a high-performing and collaborative team that values excellence, diversity of thought, curiosity, and inclusion. We value our people and empower them to achieve their ambitions - with the support, trust and autonomy to grow their careers in meaningful ways.

At MinterEllison, we're leading the way with AI and other emerging technologies, powering innovation right across our firm. You will have the opportunity to engage with AI tools we've built, and other external AI tools, to enhance efficiencies and excellence internally and with our clients.

Our IT Security team is looking for an IT Security Consultantto deliver technical security risk analysis and assurance activities across MinterEllison's technology environment. The role spans two core functions: (1) technical security risk analysis – including threat and risk assessments, security architecture reviews, and vulnerability analysis; and (2) assurance coordination – including client questionnaires, supply chain security, penetration testing oversight, user awareness, and compliance with security standards.

This is an internal role reporting into the IT Security GRC Manager. You will work closely with the broader IT Security team, IT Architecture, IT Operations, IT Procurement, and managed services providers.

Key Responsibilities

• Conduct threat and risk assessments for new and existing systems, applications, and AI solutions, producing structured risk reports with prioritised remediation recommendations
• Perform security architecture reviews on proposed and existing solutions against MinterEllison standards and applicable frameworks
• Provide security risk input into IT projects at key stages, ensuring security is embedded by design
• Analyse vulnerability scan results, triage findings by risk severity, and track remediation to closure
• Coordinate penetration testing activities including scoping, third-party coordination, and remediation tracking
• Respond to client questionnaires, audits, security program enquiries, and RFPs
• Perform supply chain security reviews andmaintainthe risk register
• Contribute to the IT Security awareness program and coordinate with broader training teams
• Assistwith maintaining ISO27001 and other compliance certification programs
• Maintain MinterEllison's Security Trust Centre with regular updates
• Run quarterly audits on privileged access, user access, mobile device compliance, and asset inventory
• Assistwith security incident response during and after business hours

Knowledge, Skills and Experience

• At least 2 years' experience in information security or IT risk, with hands-on exposure to technical security assessments
• Demonstrated ability to conduct structured threat and risk assessments using recognised methodologies (e.g. STRIDE, OCTAVE, NIST RMF)
• Practical exposure reviewing security architectures including cloud security (Azure/M365) and hybrid infrastructure
• Familiarity with vulnerability management tooling (e.g. Qualys, Tenable, CrowdStrike)
• Excellent knowledge of security frameworks such as ISO27001, SSAE16, APRA CPS234, ASD Essential 8, and NIST v2.0
• Expert coordination skills with ability tomaintainprograms on schedule
• Demonstrated experience writinghigh qualityexecutive reports/briefings
• Experience running internal IT audits and supplier assessments
• Agile mindset with ability to manage tasks independently
• Relevant certifications highly desirable (CISSP, CISM, CISA, CompTIA Security+, or cloud security certifications)

Personal Attributes

• High integrity and professionalism with excellent communication skills across all levels
• Self-starter with strong analytical and problem-solving abilities
• Excellent organisational and time management skills with attention to detail
• Strategic focus ensuring daily activities add commercial value to the business

We encourage applications from people of all ages, abilities, cultural backgrounds, genders (including trans or gender diverse), LGBTQ+ people and those with carer responsibilities. We particularly encourage Aboriginal and Torres Strait Islander people to apply.