Head of Cyber Security

Watercare; Auckland; On-site; NZD 180,000 - 240,000; Full time

Benefits offered by this job

Training and development opportunities

Life and income protection insurance

Generous parental leave

Employee discounts

Job summary

Watercare is seeking an experienced cyber security leader to join as Head of Cyber Security. Reporting to the Chief Digital Officer, you will be accountable for protecting Watercare’s information, systems and digital services by establishing and operating a fit-for-purpose cyber and information security capability.

You will lead risk identification, governance, and incident response, embed security across technology and business operations, and provide clear advisory to executives and the Board

Qualifications

• Senior leadership experience in cyber security or information security.
• Strong knowledge of cyber risk management, governance and assurance.
• Experience operating security functions within complex environments.
• Ability to communicate cyber risk clearly to non-technical executives.
• Experience leading security operations and cyber incident response.
• Strong stakeholder engagement, influencing and relationship-management skills.

Responsibilities

• Define and maintain Watercare’s enterprise cyber and information security strategy.
• Identify, assess and manage cyber risks across digital and technology services.
• Maintain the enterprise cyber risk register, including ownership, mitigation plans and reporting.
• Establish and operate security governance frameworks, policies and standards.
• Embed security-by-design principles across technology delivery and operations.
• Provide assurance on Watercare’s security posture to executive and Board governance forums.
• Oversee security monitoring, threat detection and incident response.
• Act as the senior escalation point for cyber incidents and coordinate response and recovery.
• Ensure incident response plans, playbooks and escalation pathways are established and tested.
• Lead post-incident reviews and drive continuous improvement.
• Oversee effective identity and access management practices.
• Protect sensitive information through appropriate classification, access controls and monitoring.
• Ensure compliance with relevant cyber security, privacy and regulatory requirements.
• Support internal and external audits and assurance activities.
• Lead security awareness and training programmes for our people and leaders.
• Partner with architecture, platforms, workplace, data and delivery teams to embed security across Watercare.
• Engage with external agencies, regulators and industry bodies as required.

Skills

Senior leadership

Cyber risk management

Security operations

Stakeholder engagement

Regulated environments

Security frameworks

Tools

NIST/ISO 27001

Job description

He kōrero mō mātou | About Watercare

Ki te ora te wai, ka ora te whenua, ka ora te tangata

When the water is healthy, the land and the people are healthy

There's never been a better time to join Watercare. We're delivering a $15.2 billion, 10-year capital investment programme, the largest in our history, creating opportunities to work on transformative infrastructure, sustainability and digital projects that will shape Auckland's future. With more than $4 million invested every day, you'll be part of work that makes a lasting difference to our communities and environment.

He whakamārama mō te tūranga mahi | About the role

We have an exciting opportunity for an experienced cyber security leader to join Watercare as our Head of Cyber Security.

Reporting to the Chief Digital Officer, you’ll be accountable for protecting Watercare’s information, systems and digital services by establishing and operating a fit-for-purpose cyber and information security capability.

You’ll ensure cyber risk is identified, governed, reduced and clearly communicated, while embedding practical security controls across our digital, technology and wider business operations. As a trusted advisor to executives and Board committees, you’ll provide clear advice on cyber risk, our threat posture and regulatory obligations.

In this role, you will:

• Define and maintain Watercare’s enterprise cyber and information security strategy
• Identify, assess and manage cyber risks across digital and technology services
• Maintain the enterprise cyber risk register, including ownership, mitigation plans and reporting
• Establish and operate security governance frameworks, policies and standards
• Embed security-by-design principles across technology delivery and operations
• Provide assurance on Watercare’s security posture to executive and Board governance forums
• Oversee security monitoring, threat detection and incident response
• Act as the senior escalation point for cyber incidents and coordinate response and recovery
• Ensure incident response plans, playbooks and escalation pathways are established and tested
• Lead post-incident reviews and drive continuous improvement
• Oversee effective identity and access management practices
• Protect sensitive information through appropriate classification, access controls and monitoring
• Ensure compliance with relevant cyber security, privacy and regulatory requirements
• Support internal and external audits and assurance activities
• Lead security awareness and training programmes for our people and leaders
• Partner with architecture, platforms, workplace, data and delivery teams to embed security across Watercare
• Engage with external agencies, regulators and industry bodies as required.

Ngā pūkenga e rapu nei mātou | About you

You’ll be a credible and pragmatic cyber security leader who can balance strong risk management and governance with the operational needs of a complex organisation.

You’ll be comfortable advising senior leaders and Board committees, translating technical cyber risks into clear business language and remaining calm and decisive when responding to incidents.

You will bring:

• Senior leadership experience in cyber security or information security
• Strong knowledge of cyber risk management, governance and assurance
• Experience operating security functions within complex environments
• The ability to communicate cyber risk clearly to non-technical executives
• Experience leading security operations and cyber incident response
• Strong stakeholder engagement, influencing and relationship-management skills
• A practical, risk-based approach to security
• A strong ethical and governance mindset
• Calm and credible leadership under pressure
• A collaborative approach and the ability to work across technical and business teams
• Experience in a regulated or critical infrastructure environment would be advantageous
• Familiarity with recognised security frameworks, such as NIST or ISO 27001, would be beneficial
• Experience working with external regulators or national cyber agencies would also be advantageous.

Ngā hua mōu | What's in it for you

We offer a competitive salary and staff benefits package including:

• Training and development opportunities
• Life and income protection insurance plans
• Generous parental leave
• Employee discounts at a range of large retailers