Senior Cyber Security Specialist

Whizdom; Canberra; Hybrid; AUD 140,000 - 190,000; Full time

Job summary

Whizdom is seeking an experienced cyber security professional based in Canberra with hybrid working arrangements for a 12-month contract. You will advise on governance, risk, assurance, and security architecture across enterprise and cloud environments, aligning with Australian Government requirements.

You will collaborate with the Director, Cyber, Risk and Assurance and the CIO/CISO to strengthen security controls, monitoring and incident response capabilities while contributing to policy,

Responsibilities

• Advise the Director, Cyber, Risk and Assurance and CIO/CISO on strategic, technical, operational, risk, threat, assurance and compliance matters.
• Review and challenge cyber security advice, evidence, reporting and recommendations.
• Lead or support cyber security risk assessments, control assessments, system security plans and risk documents.
• Assess security implications of cloud services, AI, automation and emerging technologies.
• Advise on enterprise and solution architecture, secure-by-design proposals and access management.
• Assess vulnerabilities, CVEs, scans and testing findings from risk/assurance perspective.
• Review logging, SIEM, monitoring and other operational cyber information for risks and gaps.
• Provide security advice to ICT and cyber projects, procurements and system owners.
• Support organisational cyber incident governance including risk assessment and escalation.
• Review and improve cyber security policies, standards, procedures and playbooks.
• Interpret and apply PSPF, ISM, Essential Eight and ASD guidance.
• Support responses to ASD Cyber Security Survey and other compliance activities.
• Improve risk registers, control libraries and executive reporting.

Job description

About the Role

The roles require substantial contemporary cyber security experience and broad knowledge across security governance, risk and assurance; enterprise and security architecture; cloud security; artificial intelligence and emerging technology risks; identity and privileged access; vulnerability and exposure management; monitoring and threat detection; incident governance and resilience; data protection; application and infrastructure security; accreditation; and Australian Government security requirements.

Primary Duties

• provide authoritative cyber security advice to the Director, Cyber, Risk and Assurance and the CIO/CISO on strategic, technical, operational, risk, threat, assurance and compliance matters
• support the Departments as the accountable risk owner by reviewing, interpreting and constructively challenging cyber security advice, evidence, reporting and recommendations
• lead or support cyber security risk assessments, control assessments, system security plans, security assessment reports, system authorisation packages, risk acceptance briefs, exemptions, improvement and remediation plans and other assurance artefacts
• assess the security implications of cloud services, artificial intelligence, automation and other emerging technologies, including security architecture, data protection, identity, access, logging, monitoring and control requirements
• provide cyber security advice on enterprise and solution architecture, secure-by-design proposals, identity and privileged access, applications, infrastructure, cloud, data protection and technology implementation decisions
• assess vulnerabilities, CVEs, vulnerability-scanning results, penetration-testing findings, threat information, control deficiencies and remediation proposals from a Departmentrisk and assurance perspective
• review logging, SIEM, monitoring, detection and other operational cyber information to identify material risks, evidence gaps and matters requiring escalation or further assurance
• provide security advice to ICT and cyber projects, procurements, business areas and system owners, including security requirements, design reviews, assurance planning, risk assessments and proportionate treatment options
• support the Departments organisational cyber incident governance role, including risk assessment, executive advice, coordination, escalation, communications, recovery priorities, lessons learned and assurance of the service-provider response
• review, update and improve the Departments cyber security policies, standards, procedures, templates, playbooks, reporting products and guidance
• interpret and apply the PSPF, ISM, Essential Eight (ASD Essentials) and other relevant ASD and Australian Government security guidance
• support the Departments responses to the ASD Cyber Security Survey and other compliance, assurance, audit and reporting requirements
• improve cyber risk registers, control libraries, assurance plans, compliance tracking, vulnerability registers and executive and committee reporting

Location and Contract Term

This role can be based in Canberra with Hybrid working arrangements

12 month contract with 2 x 12-- month contract extension options pending budget and delegate approval.

Security Requirements

Applicants must be Australian Citizens and hold a NV1 security clearance.

Applications close 29 October.