System Risk Officer

Bureau Of Meteorology; Melbourne; On-site; AUD 140,000 - 170,000; Full time

Job summary

The Bureau of Meteorology is seeking a System Risk Officer to join the Security Risk, Threat and Assessment team. The role supports security assessments for new systems and for existing systems requiring reauthorisation, under established frameworks and guidance.

Working under broad direction, you will progress security assessments from initiation to findings and recommendations that inform System Authorisation decisions and work with system managers, project teams and control owners to prepare

Qualifications

• Knowledge of cyber security risk practices and assessment methods.
• Ability to gather, analyze and document security information.
• Strong written communication and attention to detail.

Responsibilities

• Conduct security assessments as part of System Authorisation.
• Gather, analyse business, technical and security information.
• Review security control implementation and evidence.
• Prepare artefacts such as system descriptions and security plans.
• Support liaison with external security assessors and stakeholders.

Skills

Cyber risk

Security assessment

Stakeholder liaison

Job description

The System Risk Officer is a cyber security risk practitioner within the Bureau's Security Risk, Threat and Assessment team, reporting to the Manager Security Risk, Threat & Assessment/ Cyber Security Risk Lead. The role supports and conducts security assessments as part of the Bureau's System Authorisation process for new systems and for existing systems requiring retrospective assessment, review or reauthorisation.

Working under broad direction and within established frameworks, procedures and priorities, the role progresses assigned components of security assessments from initiation through to findings and recommendations that inform System Authorisation decisions. It gathers and analyses business, technical and security information, reviews security control implementation and evidence, identifies issues and risks, and seeks guidance on complex, sensitive or novel matters.

The role works collaboratively with system managers, system owners, project teams, technical specialists and control owners to prepare and maintain the artefacts needed for security assessment and System Authorisation. These may include system descriptions, system security plans, security risk assessments, control evidence, treatment plans, assessment reports, findings and draft decision briefs for review by senior team members and the relevant authorising official.

The System Risk Officer may support liaison with external security assessors, including providers undertaking independent or IRAP-aligned assessments. The role assists with assessment planning, evidence collation and provision, clarification of findings, action tracking and stakeholder updates, escalating material risks, delays or information gaps to the Cyber Security Risk Lead or System Risk Adviser.

The successful candidate will bring developing knowledge of cyber security risk and system security assessment practices, sound analytical and written communication skills, attention to detail, and the ability to explain technical issues clearly. Familiarity with the Australian Government Information Security Manual (ISM), the Protective Security Policy Framework (PSPF) and related risk frameworks is desirable. Experience supporting risk assessments involving artificial intelligence is also desirable but not essential.