Lead Cyber Security Analyst – Risk Assessments | Government

seek.com.au; Canberra; On-site; AUD 120,000 - 180,000; Full time

Job summary

Government is seeking a Lead Cyber Security Analyst to conduct hands-on risk assessments across ICT systems, Azure cloud and emerging technologies. You will identify risks, document findings, and provide actionable treatment plans while aligning with PSPF, ISM and Essential Eight controls.

You will prepare System Security Plans and annexes, engage with risk owners and executives, and help senior stakeholders understand and reduce security risks in a fast-paced government environment.

Qualifications

• At least 3–5 years' experience in government cyber security and risk assessments.
• Hands-on experience assessing Azure cloud, legacy ICT and complex systems.
• Knowledge of PSPF, ISM and Essential Eight is required.
• Experience preparing System Security Plans and related documentation.
• Ability to identify, analyse and communicate security risks and recommendations.

Responsibilities

• Conduct detailed security risk assessments of ICT systems and applications.
• Assess Azure cloud environments, legacy ICT systems, AI technologies and other complex systems.
• Identify risks, control gaps and compliance issues; develop treatment recommendations.
• Review designs against PSPF, ISM and Essential Eight.
• Prepare and maintain risk assessments, SSPs and annexes with artefacts.
• Document findings clearly and present to senior stakeholders.
• Explain cyber risks to technical and non-technical audiences.
• Collaborate across teams to implement security solutions and improve posture.
• Manage multiple assessments and competing priorities in a fast-paced environment.

Skills

Security risk assessment

Azure cloud

Stakeholder communication

Networking infrastructure

Documentation

Job description

Lead Cyber Security Analyst – Risk Assessments | Government

This is a hands-on assessment role within a high-performing Federal Government cyber security team. The successful candidate will personally conduct security risk assessments, identify and document security risks, recommend appropriate treatments, and produce high-quality security documentation.

Key responsibilities

Conduct detailed security risk assessments of ICT systems and applications

Assess Azure cloud environments, legacy ICT systems, AI technologies and other complex systems

Identify security risks, control gaps and compliance issues, and develop practical risk treatment recommendations

Review system and application designs against the PSPF, ISM and Essential Eight

Prepare and maintain security risk assessments, System Security Plans, System Security Plan Annexes and supporting security artefacts

Clearly document assessment findings, risks, controls, recommendations and residual risk

Present security findings and artefacts confidently to senior and executive stakeholders

Work with technical and non-technical stakeholders to explain cyber security risks and recommended treatments

Collaborate with cross-functional teams to implement security solutions and improve the organisation's security posture

Manage multiple assessments and competing priorities in a fast-paced environment

About you

At least 3–5 years' experience working within a government cyber security team and conducting security risk assessments

Proven hands-on experience completing security assessments for Azure cloud, legacy ICT, AI technologies and complex systems

Current and practical knowledge of the PSPF, ISM and Essential Eight

Strong experience preparing security risk assessments, System Security Plans, System Security Plan Annexes and related documentation

Demonstrated ability to identify, analyse, document and communicate security risks and recommendations

Experience providing security guidance on application, infrastructure and system designs

Strong understanding of networking infrastructure

Experience engaging with technical teams, business stakeholders, risk owners and senior executives

Excellent written communication skills, with the ability to explain complex technical risks to non-technical audiences

Must be able to obtain and maintain an NV1 security clearance