Systems Risk Adviser

Bureau Of Meteorology; Sydney; On-site; AUD 90,000 - 110,000; Full time

Job summary

The Bureau of Meteorology seeks a System Risk Adviser, a cyber security risk practitioner within the Security Risk, Threat and Assessment team, reporting to the Manager Security Risk, Threat & Assessment/Cyber Security Risk Lead.

The role conducts security assessments as part of the Bureau's System Authorisation process for new systems and for existing systems requiring retrospective assessment, review or reauthorisation.

Qualifications

• Experience conducting security risk assessments for government systems.
• Familiarity with ISM and PSPF is desirable.
• Ability to communicate complex security concepts to varied audiences.

Responsibilities

• Plan and conduct security assessments as part of the System Authorisation process for new and existing systems.
• Gather, validate and analyse system, business and technical information to determine assessment scope and dependencies.
• Prepare and quality‑assure security and risk artefacts to support authorisation decisions.
• Assess security control implementation and effectiveness, identify gaps, and provide evidence‑based recommendations.
• Maintain accurate security records, status reporting and progress actions.

Skills

Cyber security risk

System security assessments

Analytical skills

Written communication

Job description

The System Risk Adviser is a cyber security risk practitioner within the Bureau's Security Risk, Threat and Assessment team, reporting to the Manager Security Risk, Threat & Assessment/Cyber Security Risk Lead. The role conducts security assessments as a core part of the Bureau's System Authorisation process for new systems and for existing systems requiring retrospective assessment, review or reauthorisation.

Working with a level of autonomy appropriate to an APS 6, the role plans and progresses assigned security assessments from initiation through to findings and recommendations that inform System Authorisation decisions. It gathers and analyses business, technical and security information; assesses security control implementation and effectiveness; identifies control gaps and residual risks; and applies evidence and professional judgement to develop clear, defensible advice.

The role works closely with system managers, system owners, project teams, technical specialists and control owners to prepare and quality-assure the artefacts needed for security assessment and system authorisation. These may include system descriptions, system security plans, security risk assessments, control evidence, treatment plans, assessment reports, findings and decision briefs for the relevant authorising official.

The System Risk Adviser may coordinate and liaise with external security assessors, including providers undertaking independent or IRAP-aligned assessments. The role supports assessment planning and evidence provision, clarifies findings, monitors actions and dependencies, keeps stakeholders informed, and escalates material risks or barriers to the Cyber Security Risk Lead.

The successful candidate will bring sound knowledge of cyber security risk and system security assessment practices, strong analytical and written communication skills, and the ability to explain technical issues to varied audiences. Familiarity with the Australian Government Information Security Manual (ISM), the Protective Security Policy Framework (PSPF) and related risk frameworks is highly desirable. Experience conducting risk assessments involving artificial intelligence is also desirable but not essential.

The key duties of the position include:

• Plan and conduct security assessments as part of the System Authorisation process for new systems and for existing systems undergoing retrospective assessment, review or reauthorisation, in accordance with Bureau governance, security policies and applicable Australian Government requirements.
• Gather, validate and analyse system, business and technical information to determine assessment scope, security control applicability, evidence requirements and key dependencies.
• Prepare and quality-assure security and risk artefacts on behalf of system managers to support security assessment and System Authorisation, including system security documentation, cyber security risk assessments, control evidence summaries, treatment plans, assessment reports and decision briefs.
• Assess security control implementation and effectiveness, identify control gaps and residual risks, and provide evidence-based recommendations for risk treatment and authorisation decisions.
• Work collaboratively with system managers, system owners, project teams, architects, technical specialists and control owners to resolve information gaps and progress assessments to agreed quality and timeframes.
• Coordinate and liaise with external security assessors, where required, including supporting engagement planning, evidence provision, clarification of findings and tracking of agreed actions.
• Maintain accurate security assessment and System Authorisation records, registers, workplans and status reporting, and monitor conditions, actions and reauthorisation requirements for assigned systems.
• Provide clear, impartial and practical cyber security risk advice, tailored to technical and non-technical audiences, and elevate significant or unresolved risks to the Cyber Security Risk Lead.
• Contribute specialist knowledge, lessons learned and continuous improvement ideas to strengthen System Authorisation processes, templates, guidance and team capability.
• Undertake ad-hoc security risk activities stemming from PSPF-related ICT requirements and directions, including supporting security risk assessments involving artificial intelligence systems or use cases.
• Comply with all Bureau work health and safety policies and procedures, and take reasonable care for your own health and safety and that of employees, contractors and visitors who may be affected by your conduct.

Getting to know the Bureau of Meteorology

The Bureau of Meteorology is one of the few organisations that touches the lives of all Australians and all Australia, every day. The Bureau works across Australia and remote islands, providing services from the Antarctic to beyond the equator, and from the Indian Ocean to the Pacific.We are Australia's national weather, climate and water agency, in the Agriculture, Water and Environment portfolio of the Australian Government, operating under the authority of the Meteorology Act 1955 and the Water Act 2007. We provide data, information, knowledge, insight and wisdom to help Australians prepare and respond to the realities of their natural environment, including droughts, floods, fires, storms, tsunami and tropical cyclones.Our products and services include observations, forecasts, analysis and advice covering Australia's atmosphere, water, oceans and space environments. We undertake focused scientific research in support of our operations and services. Through regular forecasts, warnings, monitoring and advice, we provide one of Australia's most fundamental and widely used public services.We have strong relationships with our customers, partners and stakeholders in Australia, including the Australian Community and the emergency services sectors, all-levels of Government, and focus sectors including aviation, agriculture, energy and resources, national security and water.