Third-Party Security & Risk Analyst

Bupa; Melbourne; On-site; AUD 100,000 - 130,000; Full time

Job summary

Bupa is seeking a Third Party Security Analyst in Melbourne, Victoria. This permanent role focuses on assessing third-party security exposures and ensuring controls align with risk and regulatory requirements within a healthcare context.

You will communicate findings, coordinate remediation with stakeholders, and support incident response and security testing activities. A strong IT security background and familiarity with APRA/PCI considerations are preferred.

Qualifications

• 2-4 years’ experience in Information Security or related field.
• Knowledge of security and risk frameworks including ISO-27000 series, SABSA, CISSP and NIST.
• Experience in APRA and/or PCI regulated industry (preferred).
• Strong business acumen with customer focus.
• Excellent written and verbal communication, concise documentation.

Responsibilities

• Carry out third party security due diligence assessments before contracts.
• Evaluate supplier security maturity and gaps via questionnaires.
• Report risk findings to internal stakeholders and third-party providers.
• Monitor third party attack surfaces and coordinate remediation requests.
• Oversee remediations and validate closure.
• Support Cyber Security Incident response testing and real-world events when required.
• Coordinate security testing with remediation teams and asset protection.

Skills

Information security

Risk management

Communication

Team collaboration

Education

Tertiary IT qualification

Tools

ISO 27001 / NIST

Job description

Bupa is seeking a Third Party Security Analyst in Melbourne, Victoria. This permanent role focuses on assessing third-party security exposures and ensuring controls align with risk and regulatory requirements within a healthcare context.

You will communicate findings, coordinate remediation with stakeholders, and support incident response and security testing activities. A strong IT security background and familiarity with APRA/PCI considerations are preferred.