Vendor Risk & Security Assurance Specialist

HCF Corporation; Sydney; On-site; AUD 120,000 - 160,000; Full time

Benefits offered by this job

Flexible working arrangements

50% subsidy on health insurance and/or

Parental leave and family-friendly"

Job summary

HCF is seeking an IT Vendor Risk Specialist to strengthen how we manage technology and information security risk across our third‑party ecosystem. You will assess vendor risk, review controls, and provide practical insights to support risk decisions and regulatory compliance.

You will partner with business, Procurement, Cyber Security, and Technology teams to communicate risks, document findings, and support remediation.

Qualifications

• Experience reviewing vendor assurance artefacts such as SOC 2, ISO 27001, security questionnaires, policies and control evidence.
• Strong understanding of information security domains including access management, data protection, incident management, vulnerability management, business continuity and security governance.
• Working knowledge of ISO 27001/27002, NIST, SOC 2, COBIT, APRA CPS 234 and APRA CPS 230.

Responsibilities

• Perform IT Line 1 risk and assurance activities, including control assessments, evidence reviews and third-party risk assessments for new, existing and changed vendor engagements.
• Review vendor security and assurance documentation, including SOC 2 reports, ISO 27001 certifications, security questionnaires, policies, penetration test summaries and control evidence.
• Assess third-party controls across access management, data protection, incident management, business continuity, vulnerability management and security governance.
• Identify and document control gaps, information security risks, recommendations and residual risk considerations, and prepare audit-ready assessment reports.
• Partner with business owners, Procurement, Cyber Security and Technology teams to communicate vendor risks and support risk treatment and remediation activities.
• Maintain accurate assessment records and support internal and external audit activities through appropriate evidence and documentation.
• Contribute to the continuous improvement of vendor risk management processes, assessment templates, reporting and governance practices.

Skills

IT security

Risk management

IT audit

Compliance

Vendor risk

Education

Relevant tertiary qualifications in IT/Cyber Security or Risk Management

Job description

HCF is seeking an IT Vendor Risk Specialist to strengthen how we manage technology and information security risk across our third‑party ecosystem. You will assess vendor risk, review controls, and provide practical insights to support risk decisions and regulatory compliance.

You will partner with business, Procurement, Cyber Security, and Technology teams to communicate risks, document findings, and support remediation.