Senior Cloud GRC Security Architect (NV1) Canberra

Atturra Limited; Canberra; On-site; AUD 90,000 - 130,000; Full time

Benefits offered by this job

Career growth

Professional development

Mental health support

Parental leave

Employee referral program

Job summary

Atturra Limited is seeking a Cloud GRC Security Consultant based in Canberra, ACT. This permanent full-time role focuses on designing, delivering, and securing critical infrastructure, with a strong emphasis on ISM-aligned documentation and governance for government/defence contexts.

You will own security deliverables, work with client ISSOs/ITSAs, and contribute to high-impact projects across TG engagements, including incident response and continuous monitoring.

Qualifications

• +NV1 clearance current or sponsorship pathway.
• +Experience authoring ISM-aligned SSPs, SRMPs, IRPs for Australian Government/Defence.
• +Working knowledge of Azure security architecture (identity, network segmentation, key management, logging/monitoring).
• +Familiarity with ASD's Cloud Controls Matrix and OSCAL-based ISM tooling (desirable).

Responsibilities

• Interpret and apply ISM controls (June 2026 release) to existing architectures.
• Map application risks, threats, and controls into SRMP and SSP.
• Define incident response procedures per ASD/ACSC reporting obligations.
• Establish a continuous monitoring approach per new CTI control set.
• Coordinate document delivery with project artefacts and schedules.
• Liaise with client ISSOs/ITSAs and governance leads to validate evidence before ATO submission.
• Create SSP, SSP Annex, SRMP, Incident Response Plan, Continuous Monitoring Plan, SOPs, SCCG, and BIL assessment.

Skills

NV1 clearance

Azure security architecture

ISM controls understanding

SSP authoring

SRMP authoring

IRP authoring

OSCAL-based ISM tooling

Tools

ASD Cloud Controls Matrix template

OSCAL tooling

Job description

Atturra Limited is seeking a Cloud GRC Security Consultant based in Canberra, ACT. This permanent full-time role focuses on designing, delivering, and securing critical infrastructure, with a strong emphasis on ISM-aligned documentation and governance for government/defence contexts.

You will own security deliverables, work with client ISSOs/ITSAs, and contribute to high-impact projects across TG engagements, including incident response and continuous monitoring.