Third Party Risk Advisory Manager

Decipher Bureau; City of Melbourne; On-site; AUD 190,000 - 195,000; Full time

Benefits offered by this job

Flexible working

Health and wellbeing support

Wellbeing days

Volunteer leave

Salary packaging options

Job summary

Decipher Bureau is seeking a leadership-level risk professional to uplift our Third Party Risk Management framework in an APRA-regulated setting, guiding a team of three risk specialists. You will iterate on the CPS 220/230 framework and oversee MSP oversight, third-party assessments and security control reviews.

You will engage senior stakeholders and drive practical risk outcomes with a focus on simplifying complex environments.

Qualifications

• Experience delivering TPRM framework uplift in APRA-regulated environment.
• Strong CPS 220/230 understanding and third-/fourth‑party risk.
• Hands-on control testing, vendor assurance and MSP oversight.
• Big bank experience highly valued.
• Ability to engage senior stakeholders and simplify complex risk.

Responsibilities

• Lead and evolve a Third Party Risk Management framework.
• Perform and oversee third-party risk assessments.
• SOC 2 reviews vs control testing.
• Onsite and remote testing at MSPs.
• Assess third-party security controls (cyber-focused).
• Drive practical framework uplift.
• Lead and coach a team of 3 risk professionals.
• Partner with the CISO, security leaders, procurement, legal and compliance.
• Support incident response planning and regulatory engagement.

Skills

TPRM uplift

APRA CPS 220/230

Vendor assurance

Control testing

MSP oversight

Stakeholder engagement

Job description

This is a leadership role with an existing team and framework in place. The focus is on uplifting, streamlining and simplifying third-party risk practices (not building from scratch).

Key benefits

• Flexible ways of working, focus on outcomes, not location
• Health & wellbeing support, including access to digital health services and wellbeing programs
• Subsidised private health insurance (for eligible employees)
• Additional leave options, including wellbeing days and family-focused leave
• Community & giving programs, including paid volunteering time
• Salary packaging options, including super and novated leasing

What you'll be doing

• Lead and evolve a Third Party Risk Management (TPRM) framework aligned to APRA CPS 220 / CPS 230
• Perform and oversee third‑party risk assessments, including:
• SOC 2 reviews vs control testing
• Onsite and remote testing at Managed Service Providers (MSPs)
• Assess third‑party security controls (cyber‑focused, not just paper‑based)
• Drive practical framework uplift, applying the spirit of regulation, not just ticking sections
• Lead and coach a team of 3 risk professionals
• Partner closely with the CISO, security leaders, procurement, legal and compliance
• Support incident response planning and regulatory engagement where required

What they're looking for

• Proven experience delivering TPRM framework uplift or implementation in an APRA‑regulated environment
• Strong understanding of CPS 220 / CPS 230 and third‑party / fourth‑party risk
• Hands‑on experience with control testing, vendor assurance and MSP oversight
• Big bank experience highly valued (e.g. Westpac, CBA or similar)
• Confident engaging senior stakeholders and simplifying complex risk environments

Why this role?

• Established team, real mandate to improve
• High‑impact role with strong executive visibility
• Focus on practical risk outcomes, not bureaucracy
• Flexible ways of working, focus on outcomes, not location
• Health & wellbeing support, including access to digital health services and wellbeing programs
• Subsidised private health insurance (for eligible employees)
• Additional leave options, including wellbeing days and family‑focused leave
• Community & giving programs, including paid volunteering time
• Salary packaging options, including super and novated leasing

Additional information

• Melbourne preferred | Sydney considered
• $190k-$195k package (inc. super)
• Full working rights in AU required (No sponsorship available)