Principal Protective Security Risk Advisor - Cyber

NZ Transport Agency Waka Kotahi; Auckland; On-site; NZD 150,000 - 190,000; Full time

Benefits offered by this job

Flexible working

Five weeks annual leave

Income protection and critical illness

Professional development

Inclusive culture

Job summary

NZ Transport Agency | Waka Kotahi (NZTA) seeks a Principal Protective Security Risk Advisor - Cyber to uplift the agency’s protective security and cyber risk maturity. You will lead complex cyber risk assessments across critical services and guide secure-by-design outcomes.

You will provide expert advice using NZISM, ISO 31000 and related standards, produce risk artefacts, and influence governance through clear risk communication. CISSP/CRISC or similar certification is preferred.

Qualifications

• Extensive experience in cyber security risk assessment across critical IT services.
• Ability to lead risk assessments and prescribe controls within risk appetite.
• Familiarity with AI-assisted risk assessment approaches.
• Professional certifications preferred (CISSP, CRISC, CGRC or SABSA).

Responsibilities

• Lead cyber security risk assessments across critical NZTA systems and services.
• Provide expert advice using PSR, NZISM, ISO 31000 and industry best practice.
• Produce risk evaluation artefacts, including risk positions and security control recommendations.
• Define risk-proportionate security controls to support secure solution outcomes.
• Present cyber security risks and recommendations to governance forums.
• Use AI assisted Security Risk Assessment development methods to enhance efficiency and quality of risk identification, analysis and control identification.
• Contribute with improvements for the use of GRC tooling for risk evaluations, including evaluation of new AI features that enhance risk evaluation and management.
• Partner with project, business and technical teams to achieve accreditation outcomes.
• Strengthen cyber security control capability across NZTA through leadership and influence.

Skills

Cyber risk assessments

PSR & NZISM

ISO 31000

Risk evaluation

Stakeholder communication

AI-assisted workflows

Security governance

Team leadership

Job description

• Strengthen cyber risk capability across NZTA through expert advice


• Lead complex cyber risk assessments for critical services


• Guide secure solutions through certification and accreditation


• Location: Can be based in Auckland, Hamilton, Wellington or Christchurch

Te Whiwhinga mahi | The opportunity

This is an exciting opportunity to be part of the Protective Security Risk team and to contribute to the uplift on NZ Transport Agency | Waka Kotahi (NZTA)'s protective security capability maturity and strengthen the organisation's cyber security and protective security maturity.

We are looking for someone with a strong background in cyber security risk assessment to join our team as Principal Protective Security Risk Advisor - Cyber.

As Principal Advisor, you will work across critical corporate, regulatory and transport services and lead complex cyber security risk assessments that inform strategic and operational decision-making.

This is an opportunity to influence secure-by-design outcomes, guide certification and accreditation activities, and help deliver resilient services that support New Zealanders. We are looking for someone with a strong background in cyber security risk assessment to join our team as Principal Cyber Security Risk Advisor.

You will:

• Lead cyber security risk assessments across critical NZTA systems and services


• Provide expert advice using PSR, NZISM, ISO 31000 and industry best practice


• Produce risk evaluation artefacts, including risk positions and security control recommendations


• Define risk-proportionate security controls to support secure solution outcomes


• Present cyber security risks and recommendations to governance forums


• Use AI assisted Security Risk Assessment development methods to enhance efficiency and the quality of risk identification, analysis and control identification while retaining appropriate oversight, professional judgement, and accountability for risk outcomes.


• Contribute with improvements for the use of GRC (Governance Risk Compliance) tooling for risk evaluations, including evaluation of new AI features that have potential to enhance risk evaluation and management


• Partner with project, business and technical teams to achieve accreditation outcomes


• Strengthen cyber security control capability across NZTA through leadership and influence

You will find out more about the role here Position Description

Ko koe tēnei | About you

You're an experienced cyber security risk assessment practitioner who thrives in project teams and enjoys tackling complex, diverse IT services, conducting detailed risk analysis and prescribing fit-for-purpose security controls to manage risk within the business's risk appetite.

You will bring:

• Ability to lead security risk assessments for a broad range information services


• Experience and familiarity using common risk assessment tools


• Sound understanding of enterprise IT and services and their associated cyber risks


• Confident using conversational AI and structured prompts with context, constraints, assessment criteria and output formats for useful security analysis, rather than simple one-shot questions.


• Familiarity with AI agents to move beyond ad-hoc prompts to create repeatable AI-assisted workflows.


• Expert judgement for evaluating cyber risk severity and likelihood based on actual exposure


• Ability to articulate cyber risk findings clearly and recommend practical risk treatments


• Excellent communication and time management skills


• Proven ability to work effectively within teams and across business groups


• Enthusiasm for learning and knowledge sharing


• Industry security certifications such as CISSP, CRISC, CGRC or SABSA are preferred.

Mō mātou |About Us

At NZTA, we deliver transport networks that connect people, places and New Zealand.

Te Aukaha | Digital provides the technology and information services that enable better outcomes for our customers, partners and people.

Within Digital, Security protects NZTA's people, information and technology through resilient operations, assurance, governance and secure-by-design practices.

As part of Protective Security Risk Team, you will contribute to identifying threats and security risks to NZTA . You will be an influential advisor recommending and influencing the adoption and supporting the implementation of effective security controls and response procedures.

Ka whiwhi koe i te aha | What you will get in return

This is an opportunity to, helping strengthen the systems that support transport outcomes for New Zealand.

• Work alongside experienced security advisors and partners to identify security threats and risks and influence security improvements through best practice security measures.


• Contribute within a culture grounded in having heart, working better together, being brave and delivering meaningful outcomes.

In addition, you'll benefit from:

• Flexible working arrangements that support work-life balance


• Five weeks annual leave


• Income Protection and Critical Illness Insurance for permanent employees


• Professional development and career growth opportunities


• A collaborative and inclusive culture committed to delivering meaningful outcomes for New Zealanders

Rā Katinga | Applications close:

17 November 2026

For further information, email: [e-mail]

To be considered for this position you must have a legal right to live and work in New Zealand.

Waka Kotahi is an equal opportunity employer (EOE). We recognise the importance of diversity and inclusion and are committed to providing a working environment that embraces these values. Please let us know if you need any support or have any access requirements that will help you through the recruitment process.

Please note that we may begin shortlisting as we receive applications. We encourage early applications as we may withdraw the advertising at any time.