- 4 months initial contract with possible extensions
- Hybrid role based in Central Sydney

Data#3 is seeking an experienced Security Risk Analyst to conduct practical, risk-based security assessments of AI capabilities being considered for enterprise use. As access to a generative AI platform expands across a large user base, demand for security reviews of new connectors, integrations, models and platform features is growing fast.

This is a hands-on role for a cyber security professional who can independently assess risk, recommend controls and apply formal risk management practices, with enough AI knowledge to understand the technologies and threats involved.

Duties of the role:

- Conduct end-to-end security risk assessments of AI connectors, plugins, MCP servers, integrations, new models and platform features
- Assess identity and access models, including SSO, OAuth scopes, delegated access and permissions
- Analyse data flows to determine what information a capability can access, process, store or expose
- Identify security control gaps across identity, data security and application security, and recommend practical, proportionate controls
- Apply formal risk management processes, including risk rating, escalation, risk acceptance and exceptions
- Document transparent findings, risk ratings, recommendations and conditions for enablement
- Help develop repeatable assessment criteria,



checklists and guidance as review volumes grow
- Work with cyber security, AI, application owners and vendors to gather information and validate controls

Skills and experience

- Proven experience conducting security risk assessments, such as third-party, vendor, SaaS or application security reviews
- Strong cyber security fundamentals across identity and access management, data security, application security and security controls
- Practical experience with risk management frameworks and processes, including risk registers, escalation and risk acceptance
- A solid understanding of APIs, SaaS, cloud services and enterprise integration patterns
- Working knowledge of generative AI technologies (LLMs, connectors, MCP) and AI-specific risks such as prompt injection, data leakage and excessive agency
- The ability to work independently and manage a steady volume of reviews
- Clear, structured written and verbal communication with both technical and non-technical stakeholders

Highly regarded experience

- Experience reviewing AI tools such as ChatGPT Enterprise, Microsoft Copilot or Gemini
- Familiarity with OWASP Top 10 for LLM Applications, MITRE ATLAS, NIST AI RMF or ISO/IEC 42001

Interested candidates that meet the required skillset of the role are encouraged to apply via the link with an updated resume. Reference BIHI 114580

📌 Cyber Security Risk Analyst (Sydney)
🏢 Data#3
📍 Sydney