Senior Manager - Risk & Compliance (Cluster CISO)

Synapxe; Queenstown; On-site; NZD 130,000 - 160,000; Full time

Job summary

A leading IT risk and compliance organization based in New Zealand seeks a Senior Manager to oversee cybersecurity risks and compliance. This role involves maintaining the risk register, coordinating audits, ensuring compliance with necessary regulations, and engaging with key stakeholders. The ideal candidate should have 8-10 years of relevant experience, strong organizational skills, and preferred certifications in cybersecurity.

Qualifications

• 8-10 years in Information Security, IT Risk, Audit, or related fields.
• Strong understanding of cybersecurity risk management and compliance frameworks.
• Good communication and stakeholder management skills.

Responsibilities

• Coordinate Cybersecurity Management Committee agendas and minutes.
• Maintain and report on the Cybersecurity Risk Register.
• Facilitate audits and track findings to closure.
• Monitor compliance with sectoral requirements and policies.
• Build effective relationships with regulators and auditors.

Skills

Organisational skills

Stakeholder engagement

Analytical skills

Attention to detail

Communication skills

Education

CISSP certification

CISA certification

CISM certification

CRISC certification

Job description

Senior Manager - Risk & Compliance (Cluster CISO)

The Senior Manager, Risk & Compliance supports the effective management of cybersecurity and IT risks across Cluster. The role is responsible for maintaining the risk register, coordinating audits, ensuring compliance with regulatory and internal requirements, and driving timely closure of risk and compliance issues. The position also plays a critical role in supporting the Cybersecurity Management Committee (CMC) and acts as a bridge between operational teams, regulators, auditors, and management to provide visibility and assurance on Clusters’ cybersecurity risk posture.

Position Overview

The Senior Manager, Risk & Compliance supports the effective management of cybersecurity and IT risks across Cluster. The role is responsible for maintaining the risk register, coordinating audits, ensuring compliance with regulatory and internal requirements, and driving timely closure of risk and compliance issues. The position also plays a critical role in supporting the Cybersecurity Management Committee (CMC) and acts as a bridge between operational teams, regulators, auditors, and management to provide visibility and assurance on Clusters’ cybersecurity risk posture.

Role & Responsibilities

Cybersecurity Management Committee (CMC) Secretariat

• Serve as the secretariat to the CMC, coordinating agendas, materials, and minutes.
• Ensure timely maintenance and reporting of the Cybersecurity Risk Register to the CMC.
• Track and follow up on risk-related action items arising from CMC meetings.
• Support CMC reporting obligations to senior management, MOH, and other authorities.

Risk Assessment & Tracking

• Maintain and update the Cybersecurity Risk Register, ensuring no overdue risks.
• Support and review risk assessments for IT, OT, and Medical Devices.
• Track remediation plans and escalate where delays or risks remain unresolved.
• Facilitate the annual CII risk assessment and submission to CSA.

Audit Coordination & Risk Remediation

• Coordinate internal and external audits (CCoP, AGO, etc.).
• Prepare reports, track follow-ups, and ensure timely closure of findings.
• Act as a point of contact with CRO, internal teams, and regulators for audit matters.

Policy Compliance & Governance

• Monitor compliance against MOH, CSA, and other sectoral requirements.
• Support the design and rollout of a cluster-wide compliance programme.
• Record and manage policy deviations, ensuring recertification is performed.
• Provide inputs to MOH on policy development and ensure alignment with sectoral policies.

Operational Risk & Oversight

• Support thematic reviews, annual planning, and SOP/policy updates.
• Assist in annual ERM Control Self-Assessments, including validation of results.
• Track IT/security-related findings from AGO and sectoral reviews.
• Support oversight of Synapxe 2LoD actions and reporting.
• Manage reviews and follow-ups of cybersecurity controls for PDPC breach cases.

Stakeholder Engagement & Reporting

• Build effective working relationships with regulators, auditors, and internal stakeholders.
• Prepare dashboards and compliance reports to update senior management.
• Act as a subject matter resource for operational teams on risk and compliance issues.

Requirements

• Experience:
  • 8–10 years in Information Security, IT Risk, Audit, or related fields.
• Knowledge: Strong understanding of cybersecurity risk management, compliance frameworks, and sectoral regulations (CSA, MOH, PDPC).
• Certifications (preferred): CISSP, CISA, CISM, CRISC.
• Skills:
  • Strong organisational and coordination abilities.
  • Able to track and drive closure of risk, audit, and compliance matters.
  • Good communication and stakeholder management skills.
  • Analytical with strong attention to detail.