Profectus is seeking expressions of interest from experienced Cyber Security Program Managers with a governance, risk and compliance (GRC) focus. The work is likely to require assessing current cyber maturity against security standards and regulatory obligations across IT and operational technology (OT) environments, building the cyber risk, policy and compliance structures the organisation needs, and producing the roadmaps, business cases and Board reporting that support a multi-year uplift.
Key Responsibilities
Assess current state cyber maturity against standards such as ISO *****, NIST CSF and the Essential Eight
Map regulatory and compliance obligations and track the organisation's position against them
Develop and maintain the cyber risk management approach, risk register and risk reporting
Develop and update cyber security policies, standards and procedures
Contribute to the cyber security strategy and the prioritised, costed uplift roadmap
Write investment-ready business cases, including options analysis, costs, perks and risks
Design cyber governance structures, including committees, roles and reporting lines
Prepare compliance, risk and assurance reporting for executive and Board audiences
Coordinate internal and external audits and track remediation of findings
Run workshops with business, IT and OT stakeholders to test findings and agree priorities
Required Experience
Minimum seven years in cyber security, including GRC, assurance or uplift roles




Working knowledge of at least two of ISO *****, NIST CSF and the Essential Eight, applied in a practical assessment or uplift setting
Cyber risk assessment and risk register management
Developing cyber security policies, standards and governance structures
Developing costed, multi-year cyber roadmaps
Business case development, including options analysis and CapEx and OpEx modelling
Presenting to executive committees and Boards
Stakeholder engagement and workshop facilitation at all levels
Business writing across assessment reports, policies, business cases and Board papers
Desirable Experience
CISM, CISA, CRISC or ISO ***** Lead Implementer or Lead Auditor certification
OT security risk and frameworks such as IEC *****
Critical infrastructure environments and the Security of Critical Infrastructure Act
Developing cyber risk methodologies, business criticality models or target operating models
Consulting or advisory background, with a record of delivering the work rather than handing over a report
Working Arrangements
100% onsite
Canberra
Why Profectus
Profectus partners with Australian Government agencies to deliver trusted ICT capability across complex delivery programs. We take a long term, relationship driven approach, supporting our people across the full lifecycle of their engagement while contributing to outcomes of national importance.
#J-*****-Ljbffr

📌 Cyber Security Program Manager (Grc) (Canberra)
🏢 Profectus
📍 Canberra