Systems Risk Adviser

Bureau Of Meteorology; Hobart; On-site; AUD 90,000 - 120,000; Full time

Job summary

The Bureau of Meteorology is seeking an experienced System Risk Adviser (APS6) to help drive security risk assessments across the system authorisation process. The role requires planning and progressing assessments from initiation to findings, gathering and analysing information, and applying professional judgement to deliver clear recommendations.

You will collaborate with system managers, project teams and external assessors to prepare and quality-assure artefacts such as system descriptions,

Qualifications

• Sound knowledge of cyber security risk and system security assessment practices.
• Strong analytical and written communication skills.

Responsibilities

• Plan and progress security assessments from initiation through findings and recommendations.
• Gather, analyse business, technical and security information; assess control implementation and effectiveness.
• Prepare artefacts needed for security assessment and system authorisation (system descriptions, system security plans, risk assessments, evidence, treatment plans, reports, briefs).
• Coordinate with external assessors and providers for IRAP-aligned assessments; monitor actions and dependencies; keep stakeholders informed.

Job description

The System Risk Adviser is a cyber security risk practitioner within the Bureau's Security Risk, Threat and Assessment team, reporting to the Manager Security Risk, Threat & Assessment/Cyber Security Risk Lead. The role conducts security assessments as a core part of the Bureau's System Authorisation process for new systems and for existing systems requiring retrospective assessment, review or reauthorisation.

Working with a level of autonomy appropriate to an APS 6, the role plans and progresses assigned security assessments from initiation through to findings and recommendations that inform System Authorisation decisions. It gathers and analyses business, technical and security information; assesses security control implementation and effectiveness; identifies control gaps and residual risks; and applies evidence and professional judgement to develop clear, defensible advice.

The role works closely with system managers, system owners, project teams, technical specialists and control owners to prepare and quality-assure the artefacts needed for security assessment and system authorisation. These may include system descriptions, system security plans, security risk assessments, control evidence, treatment plans, assessment reports, findings and decision briefs for the relevant authorising official.

The System Risk Adviser may coordinate and liaise with external security assessors, including providers undertaking independent or IRAP-aligned assessments. The role supports assessment planning and evidence provision, clarifies findings, monitors actions and dependencies, keeps stakeholders informed, and escalates material risks or barriers to the Cyber Security Risk Lead.

The successful candidate will bring sound knowledge of cyber security risk and system security assessment practices, strong analytical and written communication skills, and the ability to explain technical issues to varied audiences. Familiarity with the Australian Government Information Security Manual (ISM), the Protective Security Policy Framework (PSPF) and related risk frameworks is highly desirable. Experience conducting risk assessments involving artificial intelligence is also desirable but not essential.