We are seeking an experienced Senior Cyber Risk & Exposure Management Consultant to lead the design of a modernised vulnerability risk scoring and exposure management methodology.You will design a dynamic, intelligence-driven replacement model that incorporates real-world exploit evidence, industry-specific exposure factors, and a parameterised control effectiveness framework.This is a design and advisory engagement.All work is performed on-site in Australia.Key ResponsibilitiesReview and baseline the existing risk calculation policy, scoring methodology, and supporting artefacts.Conduct structured workshops with stakeholders across Cyber Security, Networks, Operations, Engineering, Risk, and Compliance.Deliver a Discovery Report documenting the current state, gap analysis, and design principles for the replacement model.Define the full intelligence feed set spanning enterprise vulnerability intelligence, industry-specific sources, and network equipment vendor advisories.Design a replacement inherent and residual risk model incorporating exploit intelligence, probabilistic scoring, exploitation evidence flags, and asset criticality.Design industry-specific exposure factors: network reachability tier, segmentation zone, blast radius, emergency services dependency,



and operational sensitivity windows.Deliver a Designs covering target architecture, governance model, and transition from the current state with formulas, pseudo-logic, data dictionary, edge case handling, and worked examples across at least three network domains.Conduct model validation workshops and Executive Briefing.Required Skills & ExperienceDeep expertise in vulnerability risk scoring frameworks including CVSS (v3.1 and v4.0), EPSS, and CISA KEV.Proven experience designing or significantly enhancing enterprise risk calculation and exposure management models.Solid understanding of control effectiveness frameworks including the Australian Essential Eight Maturity Model and NIST CSF 2.0.Familiarity with MITRE ATT&CK; and D3FEND for threat-informed prioritisation.Experience with telco-specific security standards including GSMA FS.31, 3GPP SA3, and ENISA telco threat landscape publications.Familiarity with network equipment vendor advisory processes and how they integrate into vulnerability management workflows.Strong stakeholder engagement skills — able to facilitate workshops with senior technical and executive audiences.Excellent written communication for both technical and executive stakeholders.
#J-*****-Ljbffr

📌 Cyber Risk Consultant (New South Wales)
🏢 Dipole Group
📍 New South Wales