Our client is an established, APRA-regulated organisation with approximately 150 employees that has invested significantly in strengthening its cyber security capability.

With a NIST-aligned strategy, improved security monitoring and a defined improvement roadmap, the foundations are in place. They're now seeking a Head of Information Security & Cyber Resilience to build on this progress and lead the next stage.

The Opportunity

Reporting to the Chief Information Officer and working alongside the Head of IT, you'll lead the organisation's first-line information security and cyber resilience function, with one direct report (an Information Security Analyst) and support from specialist external providers.

You'll inherit a predominantly Microsoft setting, including Defender, Sentinel, Azure and a managed Security Operations Centre, with further improvements planned across data protection, identity security, governance and operational resilience.

In an organisation of this size, you'll need to move comfortably between strategy and execution. One day you may be advising executives on cyber risk and investment priorities; the next, resolving a technical security issue, reviewing controls or guiding remediation with your team and external providers.

Success will depend on your ability to assess competing risks, establish realistic priorities and implement proportionate security measures that the organisation can sustain.

Equally important is your ability to engage employees and business stakeholders, making cyber security understandable and building a culture where protecting information is everyone's responsibility.

What You'll Be Doing

Your responsibilities will include:

- Leading the cyber security strategy, governance framework and improvement roadmap, aligned with NIST, APRA CPS 234 and CPS 230.
- Overseeing security operations, threat detection, vulnerability management, identity security and incident response.
- Strengthening first-line controls,



coordinating independent assurance and driving remediation.
- Progressing data protection, DLP, third-party security and operational resilience initiatives.
- Providing security guidance across cloud, technology transformation and emerging AI initiatives.
- Developing the Information Security Analyst, overseeing external providers and improving security awareness across the business.

About You

We're looking for an experienced information security leader who brings:

- Broad experience across cyber strategy, governance, security operations, risk management and resilience.
- Strong knowledge of APRA CPS 234 and CPS 230, ideally gained within financial services or another highly regulated environment.
- Experience developing security strategies and delivering realistic, prioritised improvement plans.
- Sound technical knowledge of Microsoft security technologies, cloud security, identity management and security monitoring.
- Commercial judgement to balance security risks, regulatory obligations, costs and business requirements.
- Strong communication and leadership skills, with the ability to influence executives, engage employees and develop others.

Experience with Microsoft Defender, Sentinel, Purview, Azure, DLP and frameworks such as NIST CSF or ISO 27001 would be advantageous. Certifications such as CISSP, CISM or CISA are highly regarded.

Whether you're stepping into your first Head of role or bringing established leadership experience, you'll be comfortable operating in a smaller organisation where strategic ownership, technical involvement and practical delivery go hand in hand.

Working Arrangements

This is a permanent, full-time opportunity based in Sydney CBD, offering a competitive remuneration package commensurate with experience and up to 50% working from home.

Next Steps

For a confidential discussion, contact Steven Fulop on 04•• ••• 446 or [email protected], or Anthony Trimboli on 04•• ••• 782 or [email protected].

Alternatively, click Apply.

All enquiries and applications will be managed confidentially through xceltium.

📌 Head of Information Security & Cyber Resilience (Sydney)
🏢 Xceltium
📍 Sydney