Third Party Security Analyst Melbourne, Victoria

Bupa Australia; Melbourne; On-site; AUD 90,000 - 140,000; Full time

Job summary

Bupa Australia in Melbourne is seeking a Third-Party Security Analyst to partner with project teams, assessing vendor security and helping ensure controls are in place. You’ll carry out due diligence, evaluate supplier security maturity, and report risk findings to stakeholders.

If you have 2–4 years in information security and knowledge of ISO-27000, SABSA, CISSP and NIST, you’ll fit into a purpose-driven team, with opportunities to grow and contribute to safer vendor ecosystems.

Qualifications

• 2–4 years’ experience in information security or related field.
• Tertiary qualification in Information Technology or equivalent.
• Knowledge of ISO-27000 series, SABSA, CISSP and NIST.
• Experience in APRA and/or PCI regulated industry preferred; strong business focus.
• Excellent written and spoken communication; team player; vendor management experience.

Responsibilities

• Carry out third party security due diligence assessments prior to contractual agreements.
• Assess security maturity through triage and questionnaires; evaluate controls design.
• Communicate findings within a risk context and agree remediation with stakeholders.
• Monitor third party attack surface and raise remediation requests as needed.
• Support security testing and incident response exercises or simulations.
• Prepare reports on risk profiles, trends and improvement initiatives.
• Maintain Bupa’s third‑party assessments repository.

Skills

Info security

Security risk

Vendor mgmt

Stakeholder comms

Education

Tertiary IT qualification

Job description

At Bupa, purpose meets possible. Join us and help shape a future where healthcare is more connected, morepersonaland more human.

We’rea global healthcare leader trusted by millions and committed to helping people to live longer, healthier, happier lives and making a better world. Healthcare is changing, and so are we.We’reinvesting in more clinics, bettersystemsand smarter, more connected ways to help our customers. As we continue to expand our services and invest in innovation,you’llhelp create a healthcare system that meets people where they are, responds to what they need and leaves them better than before. Here, your work has purpose, your voice matters and your future is full of possibility.

Just imagine the impact you could make.

Opportunity snapshot- Permanent role

The Third-Party Security Analyst will partner with project teams that are seeking to engage with new vendors whereby its proposed they manage our regulated entities information assets and work with these vendors to perform an assessment of their information security capability to ensure adequate controls are maintained and the introduction of new security risk is avoided.

Responsibilities

• Carry out third party security due diligence assessments to inform our business of the third party’s security exposure prior to entering into contractual agreement.
• Conduct assessments through triage processes and security questionnaires to understand the supplier’s security maturity and gaps o Evaluating the design of that party’s information security controls
• Communicate and report these within a risk context and gain agreement with internal Bupa stakeholders and the third-party provider on the remediation plan
• Monitor third party’s attack surface observations and raise remediation requests where appropriate
• Perform monitoring and oversight over agreed remediations, and validation prior to closure
• Providing support to the Cyber Security Incident response team for any Third-Party incident response testing / simulations or real-world cyber incidents (where required)
• Working with Security testing teams to coordinate regular controls testing commensurate with the rate at which the vulnerabilities and threats change; and the materiality and frequency of change to information assets managed by our third parties (where required)
• Prepare scheduled and ad-hoc reports demonstrating the status of third-party security risk profiles, issues, trends, and improvement initiatives
• Supporting Security Risk Assessments (where required)
• Maintain Bupa’s third-party assessments repository

Requirements

• 2-4 years’ experience in Information Security, or a related field
• Tertiary qualifications in an appropriate Information Technology discipline or equivalent professional experience
• Knowledge of security and risk frameworks including ISO-27000 series, SABSA, CISSP and NIST
• Experience operating in an APRA and/or PCI regulated industry sector (preferred) Strong business and commercial acumen with a focus on the customer and business outcome
• Excellent oral and written communication skills including quality, concise technical documentation, report writing and presentations
• Excellent team player working within matrix structures, with demonstrated ability to broker outcomes effectively and collaboratively with colleagues and peers
• Vendor and partner management experience, including professional services and technology vendors

Why you’ll love it?

We support our people to be the healthiest and happiest versions of themselves.

We reward our people and celebrate their success. From providing initiatives that develop careers to looking after our people’s health, wellbeing and futures. Through the Viva Healthier and Happier program, we’re providing health benefits for everyone who works at Bupa, no matter their role. We want to support our people to be the healthiest and happiest versions of themselves.

If this sounds exciting, we’d love to hear from you. Let’s shape the future of healthcare, together.

At Bupa your wellbeing, identity, and personal story are respected and valued. We are continuing to build teams that reflect the diversity of the communities we serve. Bupa is committed to providing equal opportunities and fostering a workplace and environment that is free of discrimination, bullying and harassment.

We actively encourage applicants from all backgrounds and experiences, including Aboriginal and Torres Strait Islander peoples, veterans, people with disabilities, and LGBTQIA+ applicants.

We are dedicated to removing barriers to participation. If you need any reasonable adjustments during the recruitment process, or if you’d like to discuss how this role can be flexible for you, please let us know so we can support your participation on an equitable basis.