Cyber Assurance Analyst, Third Party Security

Are you ready to be part of an organisation that values expertise, passion and diversity? At CFS we know that the foundation of our success lies in our exceptional people. We believe in celebrating individuality, have a passion for high performance and create an environment where you can unleash your full potential. Our people enable us to make a difference and deliver exceptional experiences to help our customers achieve financial freedom.

Your Team

You will join the Cyber Governance, Controls and Training team within CFS's Cyber function. The team strengthens cyber governance, controlling effectiveness, training, awareness and assurance outcomes across the organisation, helping CFS manage cyber risk in a way that protects customers, supports regulatory obligations and enables safe business growth.

At CFS, we're committed to leveraging AI to enhance how we work and serve our customers. You'll be expected to actively explore and adopt AI tools to scale efficiently, improve experience, quality, and innovation in your role. We'll provide training and support to build your AI capability, and you'll be encouraged to share learnings with your colleagues as we build our AI-enabled future together.

Your Responsibilities

- Support and coordinate cyber assurance activities across the supplier lifecycle, including onboarding, ongoing oversight, material change assessments and contract renewals.
- Review supplier information and supporting evidence to identify potential cyber risks, gaps, inconsistencies and matters requiring further investigation.
- Contribute practical,



risk-based recommendations that support informed business and risk decisions.
- Partner with business stakeholders to identify, manage and remediate supplier-related cyber risks.
- Monitor supplier security posture and identify changes or indicators requiring review.
- Prepare reporting, metrics and insights for governance forums, risk management activities and regulatory obligations.
- Use approved AI tools to improve assessment efficiency, evidence analysis, reporting and monitoring activities.
- Contribute to improvements in third-party cyber assurance processes, templates, guidance and tools.
- Maintain accurate, complete and audit-defensible assessment and assurance records.

Your Capability and Experience

- Relevant practical experience in cyber security, third-party risk, assurance, audit, governance, risk and compliance, or a related field, gained through employment, a graduate program, internship or substantial industry-based project work.
- Foundational understanding of cyber security, risk and control concepts, including the ability to distinguish between risks, controls, evidence, findings and remediation actions.
- Experience reviewing questionnaires, policies, control descriptions, certifications, audit findings or assurance reports to identify gaps and matters requiring further investigation.
- Sound analytical and problem-solving skills,



with the ability to assess information, identify potential risks and contribute to practical, risk-based recommendations.
- Effective communication and relationship-building skills, with the ability to work collaboratively with technical and non-technical stakeholders.
- Ability to communicate findings clearly and concisely through written assessments, reporting inputs and verbal updates.
- Good planning and organisational skills, with the ability to manage assigned assessments, follow established methodologies, meet agreed timeframes and escape matters requiring guidance.
- Robust attention to detail and developing risk judgement, with the ability to handle sensitive information appropriately.
- A willingness to learn, respond positively to feedback and contribute ideas that improve assurance processes, reporting and stakeholder outcomes.
- Direct experience supporting cyber assurance, third-party risk management, supplier security assessments, technology risk, audit or governance, risk and compliance activities within a large, complex or regulated organisation.
- Familiarity with cyber security frameworks and regulatory standards such as ISO/IEC 27001, NIST Cybersecurity Framework, Essential Eight, APRA CPS 234 or APRA CPS 230.
- Exposure to governance, risk and compliance platforms, supplier risk management tools, security-rating services, data analytics, automation or approved AI-enabled technologies.

What to Expect

At CFS, you'll be working among the very best in the wealth management industry. It's an inspiring environment that encourages development and

📌 Cyber Assurance Analyst, Third Party Security (Sydney)
🏢 Colonial First State
📍 Sydney