Security Analyst

ASX; Sydney; Hybrid; AUD 140,000 - 180,000; Full time

Benefits offered by this job

Flexible working

Hybrid work options

Job summary

ASX is seeking an experienced cyber governance professional to help uplift controls, produce metrics and dashboards, and partner with security teams across the organisation. The role focuses on data-driven reporting, risk-informed decision making, and enhancing visibility into cyber health.

You will work with stakeholders across technology and risk to translate complex data into actionable insights, maintain governance artefacts, and support regulatory and assurance activities in a hybrid

Qualifications

• 5–8 years' experience in cyber or tech governance, risk, compliance or assurance.
• Working knowledge of identity and access management, detection and monitoring, patching and vulnerability management.
• Familiar with frameworks such as NIST CSF, ISO 27001, ASD Essential Eight, CPS 234, COBIT and MITRE ATT&CK.
• Ability to analyse and visualise technical data for diverse audiences using BI tools.
• Able to manage multiple governance artefacts with accuracy and version control.

Responsibilities

• Support vulnerability management analysis and reporting.
• Uplift and document cyber security controls following best-practice frameworks.
• Partner with cyber SMEs to assess, plan, remediate IT general controls.
• Develop and maintain cyber governance dashboards and metrics.
• Consolidate data from scanners, CMDB and identity systems to identify gaps.
• Translate control definitions into traceable metrics.
• Create visuals for stakeholders using Power BI, Tableau or Excel.
• Prepare assurance artefacts and reporting packs.
• Support automated reporting and integration into risk systems like ServiceNow.
• Maintain documentation repositories and versioned governance artefacts.

Skills

Governance analysis

Risk & compliance

Data storytelling

Stakeholder engagement

Written & verbal comms

Tools

Power BI

Tableau

Excel

Job description

ASX: Powering Australia's financial markets

Why join the ASX?

When you join ASX, you’re joining a company with a strong purpose – to power a stronger economic future by enabling a fair and dynamic marketplace for all.

In your new role, you’ll be part of a leading global securities exchange with a strong brand. We are known for being a trusted market operator and an exciting data hub.

www.asx.com.au/about/careers/a-great-place-to-work

We are more than a securities exchange!

The ASX team brings together talented people from a diverse range of disciplines.

We run critical market infrastructure, with 1 in 3 people employed within technology. Yet we have a unique complexity of roles across a range of disciplines such as operations, program delivery, financial products, investor engagement, risk and compliance.

We’re proud to foster a workplace where diversity is celebrated and inclusion is part of our everyday culture. Our employee‑led networks champion LGBTIQ+ inclusion, promote gender equality, accessibility and wellbeing, inspire giving and volunteering, and celebrate cultural and religious events, creating a sense of belonging for all. As an AWEI Bronze employer and member of the Champions of Change Coalition for gender equality, we’re committed to a fair and inclusive workplace where everyone can thrive.

YOUR RESPONSIBILITIES

• Support vulnerability management analysis and reporting.
• Support the uplift and documentation of cyber security controls in line with best‑practice frameworks, including NIST, focusing on key domains such as Identity and Access Management, Detection and Monitoring, and Vulnerability Management.
• Partner with cyber subject matter experts to assess, plan, remediate and uplift IT General Controls, including strengthening definitions, evidence requirements and reporting.
• Develop and maintain cyber governance dashboards and metrics to demonstrate compliance with cyber security requirements and obligations across key control domains, such as patching, vulnerability management and identity.
• Consolidate and analyse technical data from sources such as vulnerability scanners, CMDB and identity systems to identify compliance gaps and emerging trends.
• Translate IT general security control definitions and governance cadence into traceable, actionable and sustainable metrics.
• Translate technical data into clear visual insights for different audiences, including IT service owners, senior management and risk committees, using tools such as Power BI, Tableau or advanced Excel.
• Prepare assurance, audit and regulatory artefacts by coordinating high‑quality evidence and reporting packs.
• Support the uplift of automated reporting and integration into the risk system, ServiceNow and other data platforms to enhance transparency of cyber health.
• Maintain documentation repositories, exception registers and data sources to ensure traceability and version control across governance artefacts.
• Maintain any custom code in GitLab in accordance with development standards.
• Identify opportunities to automate and streamline cyber reporting, metrics and control‑related data flows.
• Work with the Security Operations Centre and other security teams where required.

YOUR EXPERIENCE AND QUALIFICATIONS

Must have

• 5–8 years’ experience in cyber or technology governance, risk, compliance or assurance roles, with exposure to data‑driven reporting and metrics.
• Working knowledge of cyber control domains such as identity and access management, detection and monitoring, patching and vulnerability management.
• Good understanding of frameworks and standards, such as NIST CSF, ISO 27001, ASD Essential Eight, CPS 234, COBIT and MITRE ATT&CK.
• Demonstrated ability to analyse and visualise technical data using tools such as Power BI, Tableau or advanced Excel.
• Good written and verbal communication skills, including the ability to translate technical or complex data into insights for technical and non‑technical audiences.
• Proven ability to manage multiple governance artefacts, such as control registers, penetration‑testing findings, exception logs, dashboards and evidence, with attention to accuracy and version control.
• Skilled in coordination, reporting and stakeholder engagement across technical and risk functions.

Nice to have

• Experience supporting or reporting on IT General Controls or control‑effectiveness outcomes.
• Familiarity with enterprise risk systems and their data structures.
• Familiarity with Security Information and Event Management tools, such as Elastic.
• Exposure to data integration or automation between systems such as CMDB, vulnerability management and reporting tools.
• Experience developing or enhancing cyber, technology or risk dashboards.
• Knowledge of data storytelling or visual communication principles to convey risk posture and control effectiveness.
• Professional certifications such as CISA, CRISC, CISSP or ITIL.
• Experience working in a regulated or audited technology environment, such as financial services or critical infrastructure.

We make hiring decisions based on your skills, capabilities and experience, and how you’ll help us to live our values. We encourage you to apply even if you don’t meet all the criteria of this role.

If you need any adjustments during the application or interview process to help you present your best self, please let us know at *******@asx.com.au.

At ASX Group, our diverse workforce is essential to build and maintain a fair and dynamic marketplace. We support flexible working and offer hybrid working options. Even if our roles are advertised as full‑time, we encourage you to apply if you are interested in part‑time or other flexible working arrangements.

We will arrange for successful candidates to have background checks, including reference and police checks, completed as part of the on‑boarding process.

To be considered for this position, candidates must be legally authorised to work in Australia on a permanent basis without any restrictions.

Be careful - Don’t provide your bank or credit card details when applying for jobs. Don't transfer any money or complete suspicious online surveys. If you see something suspicious, report this job ad.