You've built solid experience in vulnerability management. Now you're ready to take greater ownership, improve existing practices and see the impact of your work across a complex technology environment.

Our client, a national not-for-profit healthcare organisation, is looking for a Cyber Security Engineer – Exposure Management to help strengthen its vulnerability-management capability.

The opportunity

The organisation has established security tools, but vulnerability management needs more consistent processes, reporting and remediation coordination.

Reporting to the Director of Cyber Defence and Engineering, you'll assess the current environment and implement practical improvements to how security exposures are identified, prioritised and managed. You'll receive technical direction and support while taking ownership of agreed deliverables.

By 30 June 2027, the focus is on achieving three key outcomes:

- Visibility: Establish a more comprehensive view of the organisation's vulnerabilities, supported by reliable reporting and risk-based prioritisation.
- Compliance: Strengthen vulnerability-management practices and evidence to support Security of Critical Infrastructure obligations and Essential Eight maturity.
- Sustainability: Implement and document repeatable processes, with clear ownership and handover arrangements so improvements can be maintained beyond your engagement.

What you'll be doing

Your responsibilities will include:

- Assessing existing vulnerability-management practices, processes and reporting to identify gaps and priorities.
- Improving the vulnerability-management lifecycle, including discovery, prioritisation, remediation tracking, exceptions and closure.
- Working with infrastructure,



cloud and other technology teams to coordinate remediation and validate outcomes.
- Optimising existing security tools to improve asset coverage, data quality and vulnerability visibility.
- Building practical dashboards and reporting that help technical teams and leadership make informed remediation decisions.
- Supporting Essential Eight uplift activities, including gap assessments, remediation planning and evidence collection.
- Documenting procedures and workflows, with practical knowledge transfer to support ongoing operations.

You'll work with technologies including CrowdStrike, Microsoft Defender and supporting vulnerability and patch-management tools.

You won't be expected to personally remediate every vulnerability. Your role is to work with the teams responsible for implementing fixes, providing guidance and maintaining visibility of progress.

What you'll bring

We're looking for someone with robust practical vulnerability or exposure-management experience who is ready for greater responsibility.

You'll ideally bring:

- Hands-on experience identifying, assessing and prioritising vulnerabilities using relevant security technologies.
- A sound understanding of vulnerability-management lifecycles, including remediation tracking, validation and reporting.
- Knowledge of security risks across infrastructure, endpoints, networks or cloud environments.
- The ability to collaborate with technical teams,



communicate findings and influence remediation priorities.
- Initiative, accountability and experience improving technical processes or ways of working.

Familiarity with the Essential Eight and experience with CrowdStrike or comparable technologies would be advantageous, but specific product experience isn't essential.

Healthcare experience is not required.

What matters most is your ability to demonstrate practical delivery, take ownership and follow through on agreed outcomes.

Contract details and next steps

This is a full-time fixed-term appointment ending 30 June 2027, offering remuneration equivalent to approximately $154,000 base salary plus 12% superannuation annualised. Total remuneration will be pro-rated according to the actual contract period.

Eligible employees may also access not-for-profit salary packaging benefits, providing potential additional tax savings.

This is initially an eight-month fixed-term appointment while the organisation integrates a recent acquisition. Importantly, the CISO sees an ongoing need for this capability and would ideally like the role to become permanent. While this will depend on the future organisational structure and approvals, there is genuine potential for a longer-term opportunity.

The role offers hybrid working, with a minimum of two days per week onsite. Sydney or ACT is preferred, although other East Coast locations may be considered.

For a confidential discussion, please contact:

- Steven Fulop at xceltium on 04•• ••• 446 or [email protected]
- Anthony Trimboli at xceltium on 04•• ••• 782 or [email protected]

All applications and enquiries will be treated confidentially.

📌 Cyber Security Engineer – Exposure Management (Sydney)
🏢 Xceltium
📍 Sydney