Team Leader, Security Governance, Risk & Reporting

Greater Western Water; Melbourne; Hybrid; AUD 150,000 - 210,000; Full time

Benefits offered by this job

Hybrid work model

Free onsite parking

Parental leave 16 weeks

Work Life Balance Days

Income protection

Health insurance deals

Wellbeing rooms

Job summary

Greater Western Water is seeking a Team Leader to steer governance, risk and reporting for cyber security. You’ll lead a high-performing team, partner with technology and business leaders, and drive security-by-design across the organisation.

This role sits in a critical infrastructure context with exposure to regulatory obligations and board reporting. The role offers flexible on-site and work-from-home arrangements, with focus on resilience, maturity improvements, and risk management;

Qualifications

• Significant experience in cyber security governance, risk, compliance and assurance in regulated environments.
• Experience implementing NIST CSF, VPDSS and PCIDSS with maturity assessments and risk-based improvement planning.
• Knowledge of SOCI Act and CIRMP obligations for critical infrastructure.
• Experience in cyber risk assessments, risk registers, audits, compliance reviews, remediation programs and third-party security risks.
• Ability to lead security governance and communicate cyber risk with metrics, KRIs, maturity reporting and roadmaps.

Responsibilities

• Lead the development, implementation and continuous improvement of GWW's cyber security governance framework, ensuring policies, standards, procedures and controls remain effective and aligned to business objectives and regulatory requirements.
• Oversee the identification, assessment, treatment and monitoring of cyber security risks across information technology, operational technology, information assets and third-party environments.
• Drive cyber security compliance and assurance activities, including audits, security assessments and regulatory obligations, ensuring findings and remediation actions are delivered.
• Develop and deliver meaningful cyber security reporting, metrics and dashboards to provide insights on risk, compliance, maturity and performance to executive leaders, committees and the Board.
• Champion cyber security awareness, education and behavioural change initiatives that strengthen security culture and reduce human-related cyber risk across the organisation.
• Lead security assurance and control management activities, ensuring controls remain effective and continuously improved to address emerging risks.
• Build, coach and develop a high-performing Security Governance, Risk & Reporting team, fostering capability growth and collaboration.
• Partner with business, technology and operational leaders to provide trusted advice and drive continuous improvement in cyber security maturity.

Skills

Cyber security governance

Risk management

Compliance

Security assurance

NIST CSF

VPDSS

PCIDSS

SOCI Act

CIRMP

Third-party risk

Security metrics

KRIs

Leadership

Job description

Team Leader, Security Governance, Risk & Reporting

GWW is a Victorian government owned water corporation that provides an essential service to some of the fastest-growing communities in Australia, stretching from Melbourne's CBD to Lancefield in the north and Bacchus Marsh in the west. Click here to learn more

• We embrace flexibility and connection with a balance of on-site and WFH
• Free onsite parking (subject to availability)
• Gender neutral, 16-week parental leave available from commencement
• Eligible full-time employees may access additional Work Life Balance Days, subject to eligibility criteria, helping you prioritise wellbeing and flexibility.
• Free income protection and salary continuance insurance
• Access to corporate health insurance deals with major providers
• Wellbeing, prayer, and sensory rooms in the Footscray and Sunbury office

The opportunity

This is a unique opportunity to lead and shape the cyber security governance, risk and reporting function at GWW, playing a critical role in protecting the organisation's digital and operational environments. As a key member of the Security leadership team, you will drive cyber security strategy through governance, risk management, compliance, assurance, awareness and reporting initiatives that strengthen organisational resilience. Leading a high-performing team, you will partner with technology, operational and business leaders to embed security-by-design principles, enhance cyber security maturity and foster a strong security culture across the organisation. This highly visible role offers the chance to influence cyber security decisions, provide trusted advice to senior stakeholders and regulators, and champion continuous improvement in a complex and evolving cyber security landscape.

Responsibilities

• Lead the development, implementation and continuous improvement of GWW's cyber security governance framework, ensuring policies, standards, procedures and controls remain effective and aligned to business objectives and regulatory requirements.
• Oversee the identification, assessment, treatment and monitoring of cyber security risks across information technology, operational technology, information assets and third-party environments.
• Drive cyber security compliance and assurance activities, including audits, security assessments and regulatory obligations, ensuring findings and remediation actions are successfully delivered.
• Develop and deliver meaningful cyber security reporting, metrics and dashboards to provide insights on risk, compliance, maturity and performance to executive leaders, committees and the Board.
• Champion cyber security awareness, education and behavioural change initiatives that strengthen security culture and reduce human-related cyber risk across the organisation.
• Lead security assurance and control management activities, ensuring controls remain effective, fit for purpose and continuously improved to address emerging risks.
• Build, coach and develop a high-performing Security Governance, Risk & Reporting team, fostering capability growth, collaboration and a customer-focused culture.
• Partner with business, technology and operational leaders to provide trusted advice, embed security-by-design principles, and drive continuous improvement in cyber security maturity and organisational resilience.

Skills & Experience

• Significant experience in cyber security governance, risk, compliance and assurance, preferably within a critical infrastructure, essential services or highly regulated environment.
• Demonstrated experience implementing and operationalising the NIST Cybersecurity Framework (NIST CSF), Victorian Protective Data Security Standards (VPDSS) and Payment Card Industry Data Security Standard (PCIDSS) including maturity assessments, gap analysis, risk-based improvement planning and security governance.
• Strong knowledge and practical experience with the Security of Critical Infrastructure Act 2018 (SOCI Act) and Critical Infrastructure Risk Management Program (CIRMP) obligations, including enhanced cyber security obligations applicable to critical infrastructure.
• Strong experience in cyber security risk and assurance, including cyber risk assessments, risk registers, control effectiveness, audits, compliance reviews, remediation programs and third-party security risks.
• Demonstrated ability to lead security governance and communicate cyber risk, including security metrics, KRIs, maturity reporting, regulatory compliance and strategic improvement roadmaps.

See yourself thrive

Our vision for GWW is Thriving People and Country. We aim to be as diverse as the communities we serve and are deeply committed to building a workplace where everybody thrives. We're supportive, inclusive, and friendly, and value everyone for who they are and what they can bring.

We're seeking applicants across all cultural backgrounds, genders, and abilities, and will make reasonable adjustments as required, so please talk to us about what you need.

The successful candidate will be required to complete pre-employment checks, including reference checks, medical assessments, a national police check, and verification of working rights in Australia.

Please note: this role has been classified as a Critical Worker under the Security of Critical Infrastructure (SOCI) Act and GWW's Critical Infrastructure Risk Management Program. As such, the successful candidate will also be required to undergo additional security clearance checks in line with legislative obligations.