IT Vendor Risk Specialist

HCF (Australia); Sydney; Vor Ort; AUD 90.000 - 130.000; Vollzeit

Benefits dieser Stelle

Flexible working arrangements

Parental leave

Wellbeing programs

Career development

Zusammenfassung

HCF is seeking an IT Vendor Risk Specialist to strengthen risk management across our third-party ecosystem in Australia. You will assess vendor risk, review security controls and provide practical insights to support risk decisions and regulatory compliance.

You will partner with Business, Procurement, Cyber Security and Technology teams to communicate risks, produce audit-ready assessments and drive improvements in our vendor risk programs.

Qualifikationen

• 3+ years in information security, risk management, or IT audit.
• Experience reviewing vendor assurance artefacts like SOC 2, ISO 27001, security policies.
• Ability to translate complex risk concepts into practical recommendations.

Aufgaben

• Perform IT risk and assurance activities for vendor engagements.
• Review vendor security documentation (SOC 2, ISO 27001, policies, control evidence).
• Assess third-party controls (access, data protection, incident, BCM, vulnerability, governance).
• Document control gaps, risks, recommendations and residual risk for audit-ready reports.
• Collaborate with stakeholders across business, Procurement, Cyber Security and Technology.

Kenntnisse

Vendor risk management

SOC 2 review

ISO 27001

APRA CPS 234

Risk assessment

Ausbildung

Bachelor's degree in IT or Cyber Security

Tools

GRC tools

Security questionnaires

Jobbeschreibung

Join HCF as an IT Vendor Risk Specialist and help strengthen how we manage technology and information security risk across our third-party ecosystem. You will work across business and technology teams to assess vendor risk, evaluate security controls and provide practical insights that support informed risk decisions and regulatory complianceKey ResponsibilitiesPerform IT Line 1 risk and assurance activities, including control assessments, evidence reviews and third-party risk assessments for new, existing and changed vendor engagements.Review vendor security and assurance documentation, including SOC 2 reports, ISO 27001 certifications, security questionnaires, policies, penetration test summaries and control evidence.Assess third-party controls across areas including access management, data protection, incident management, business continuity, vulnerability management and security governance.Identify and document control gaps, information security risks, recommendations and residual risk considerations, and prepare clear, audit-ready assessment reports.Partner with business owners, Procurement, Cyber Security and Technology teams to communicate vendor risks and support agreed risk treatment and remediation activities.Maintain accurate assessment records and support internal and external audit activities through appropriate evidence and documentation.Contribute to the continuous improvement of vendor risk management processes, assessment templates, reporting and governance practices.Skills & Experience Required3+ years’ experience in information security, risk management, technology risk, IT audit or compliance.Good understanding of IT processes, operational controls and Line 1 control responsibilities.Experience reviewing vendor assurance artefacts such as SOC 2, ISO 27001, security questionnaires, policies and control evidence.Strong understanding of information security domains including access management, data protection, incident management, vulnerability management, business continuity and security governance.Working knowledge of relevant security and risk frameworks including ISO 27001/27002, NIST, SOC 2, COBIT, APRA CPS 234 and APRA CPS 230.Strong analytical and risk-based thinking, with the ability to identify control gaps and translate complex technical and risk concepts into clear, practical recommendations.Strong stakeholder engagement and communication skills, with the ability to collaborate across business, Procurement, Cyber Security, Technology and Risk teams.Relevant tertiary qualifications or equivalent experience in Information Technology, Cyber Security or Risk Management. Certifications such as CISSP, CISA, CISM, CRISC or ISO 27001 Lead Auditor are highly regarded but not essential.About HCFAt HCF, our purpose is to bring our human touch to healthcare. Since 1932 we’ve been putting our members and their health first. As Australia’s largest not-for-profit health fund, we cover 2 million members with health, life, travel and pet insurance and our vision is to make healthcare understandable, affordable, high quality and member centric.We want to be true health partners to our members, easily guiding the healthcare choices that are right for them. At HCF, our values are the way we do things and create the necessary culture to help us realise our purpose and deliver our Strategy. Living our values in action we step forward, walk in their shoes, stay human, make it better and get there together.Culture & BenefitsPurpose-driven passionWe’re united by a common purpose: to make healthcare affordable, understandable, high quality and member-focused.Wellness and work-life balanceWe’ll empower you with the necessary skills and tools to support your personal wellbeing journey, ensuring you perform at your best. Our offerings include:Flexible working arrangements50% subsidy on HCF hospital and/or extras coverFamily-friendly certified employer18 weeks of parental leave for all new parentsMental health and wellbeing programs, including workshops, fitness classes, flu vaccinations, skin checks and moreDiscounts on HCF’s products, including life, pet and travel Insurance, as well as discounts at Fitness First gyms and on our eyecare products.Collaboration and inclusivityWe embrace diversity as our strength and are committed to maintaining an inclusive and collaborative work environment. Our workplace is welcoming and safe for all our employees, irrespective of their unique characteristics including age, ethnicity, cultural or spiritual background, gender identity, disability, education and socio-economic status.Continuous learning and growthWe believe in lifelong learning. HCF provides opportunities for personal and professional development. From workshops to mentorship programs, we encourage your growth and curiosity.Next stepsIf you require any adjustments to assist you in making your application or during the recruitment or onboarding process, please reach out to Talent Acquisition – [e-mail] to discuss or call 02 9290 0464.We encourage applicants to submit their applications at their earliest convenience, as at HCF, we review applications as they are submitted, and may have filled the role prior to the job closing date.Please be aware of recruitment scams, phishing, and impersonation attempts. HCF will never request payment or sensitive financial information at any stage of the recruitment process. If you receive suspicious communications claiming to be from HCF, please verify them through our Careers page or contact us directly.