Protect what matters.
Strengthen cyber resilience.
Help shape a security-conscious culture.At David Jones, we are committed to creating secure, seamless and trusted experiences for our customers and our people.
We are looking for a Cyber Security & GRC Analyst who can combine hands‐on security operations with practical governance, risk and compliance expertise.This is a broad and highly collaborative role where you will monitor and respond to security events, coordinate vulnerability remediation, strengthen our cyber control environment and help embed secure behaviours across the organisation.Working across Technology and the broader business, you will translate technical security information into clear, risk-based actions that protect our operations while enabling innovation and progress.What will your day look like?
In this role, you will:Monitor and triage security alerts, events and reported concerns, escalating and coordinating responses in line with established processesSupport the investigation of security incidents, including evidence gathering, root‐cause analysis and identification of recurring issuesCoordinate vulnerability scanning and work with system owners to prioritise remediation, patching and risk treatmentTrack vulnerabilities, control gaps and remediation actions through to closureSupport identity and access management activities, including access reviews, privileged access checks and least‐privilege assuranceMaintain cyber security policies, standards, procedures and the security control frameworkSupport cyber and technology risk assessments, control assurance activities and continuous control monitoringCoordinate evidence and stakeholder responses for internal and external auditsHelp maintain alignment with frameworks and obligations including the Essential Eight,



NIST Cybersecurity Framework, ISO *********** and PCI DSSCoordinate cyber security awareness campaigns, training and phishing simulationsPrepare operational and GRC reporting across incidents, vulnerabilities, risks, controls, audits and awareness measuresProvide clear, practical security advice to Technology teams, project teams and stakeholders across the businessIdentify opportunities to automate, simplify and strengthen security processes, controls and reportingWhat will you need to thrive?
You will bring approximately three years of experience across cyber security operations, cyber GRC, technology risk, audit or a comparable role combining these disciplines.You will also have:Hands‐on experience in security alert triage, incident analysis, vulnerability management and remediation coordinationExperience supporting cyber risk assessments, control assurance, policy maintenance, audits and remediation trackingWorking knowledge of security frameworks and standards such as the Essential Eight, NIST Cybersecurity Framework, ISO *********** and PCI DSSExposure to security technologies across identity, email, endpoint, cloud and vulnerability managementExperience with Microsoft security solutions and tools such as Proofpoint, CrowdStrike, Cortex, Rapid7 or TenableThe ability to analyse security information,



identify patterns and translate technical findings into practical business actionsStrong stakeholder engagement, organisation and follow‐throughThe ability to balance operational security priorities with scheduled governance and compliance activitiesStrong written communication skills, with the ability to develop concise policies, procedures, reports, training materials and management updatesExperience delivering cyber awareness communications, training or phishing simulationsA relevant qualification in cyber security, information technology, risk or a related discipline, or equivalent practical experienceRelevant industry certifications, or active progress toward certification, will be highly regarded.Why join David Jones?
Our purpose is to inspire like no other, and our people bring this to life every day.At David Jones, you will join a culture where people are encouraged to be customer obsessed, empowered, inclusive and creative.
You will have the opportunity to work across a complex and iconic retail organisation, partnering with diverse teams to improve cyber resilience and build greater security capability across the business.This role offers the chance to broaden your exposure across both cyber security operations and GRC, contribute to meaningful security improvements and help shape a culture where protecting our customers, people and business is everyone's responsibility.Ready to inspire like no other?
If you are curious, collaborative and motivated by turning cyber risk into practical action, we would love to hear from you.David Jones is committed to creating an inclusive workplace where everyone feels respected, valued and empowered to thrive.
We welcome applications from people of all backgrounds, experiences and perspectives.
#J-*****-Ljbffr

📌 Cyber Security & Grc Analyst (Melbourne)
🏢 David Jones
📍 Melbourne