Reporting to the Assistant Secretary of Cyber Security, we are looking for two Directors to join our dynamic cyber security branch - the Director of Cyber Governance & Education and the Director of Cyber Assurance.

Director - Cyber Governance and Education (IT Security Advisor)

The Director of Cyber Governance and Education is unique position in which the Director is also the departmental IT Security Advisor (ITSA). The Director is responsible for providing day-to-day cyber security guidance, maintenance of departmental cyber security policies, and awareness campaigns.

Director - Cyber Assurance The Director of Cyber Assurance is responsible for the independent assessment of cyber security controls to ensure that they are operating effectively. The Director oversees a team of Governance-Risk-and-Compliance (GRC) specialists and supports the Authority to Operate process.

This position is available on an ongoing basis. Future positions may be offered on an ongoing or non-ongoing basis for up to 12 months initially.

Responsibilities of the Director of Cyber Governance & Education include:

- Lead, develop and support a multidisciplinary team to deliver high-quality cyber security advice and education services to the department and its client agencies.
- Act as the department’s principal operational adviser on information and ICT security.
- Provide authoritative interpretation of security policy and control requirements aligned to the Protective Security Policy Framework (PSPF), Information Security Manual (ISM), and relevant legislative requirements.




- Escalate non-compliant requirements, emerging risks and risks above the department’s acceptable threshold to the CISO or appropriate delegate.
- Monitor emerging technologies, threat landscapes, and government policy changes to inform strategic decision-making and appropriate risk management strategies.
- Embed cyber security requirements across the ICT lifecycle, including as part of the design, architecture, procurement, operation and decommissioning process.
- Provide authoritative advice to senior executives on cyber security, risk, and governance matters.
- Lead the preparation of ministerial, executive, audit, and governance committee briefs relating to cyber and information security risks.
- Drive a solid organisational security culture through awareness, training and education programs.

Responsibilities of the Director of Cyber Assurance include:

- Lead, develop and support a multidisciplinary team to deliver risk-based assessments and effective Authority to Operate outcomes for ICT systems.
- Oversee all supporting Authority to Operate activities including stakeholder engagement, coordination of supporting evidence, cyber security assessments including relevant treatments,



and providing a recommendation to the authorising officer on whether the residual risk is acceptable.
- Provide both system-specific and strategic advice on cyber security risk and control effectiveness aligned with the Protective Security Policy Framework (PSPF), Information Security Manual (ISM), and relevant legislative requirements.
- Maintain a single authoritative register for all assessed systems, including the conditions under which they were authorised to operate.
- Oversee continuous monitoring to ensure systems operate within their authorised conditions, progress against recommended treatments and identify any significant architectural or security changes to the system which may require reassessment.
- Manage third-party and supply chain cyber assurance programs, including risks associated with Foreign Ownership Control and Influence.
- Drive risk-based assurance reporting for executives and governance committees.

Please note, under section 22(8) of the Public Service Act 1999, employees must be Australian citizens to be employed in the APS unless the Agency delegate has agreed, in writing.

This is a designated security assessed position. The successful candidate will have the ability to obtain and maintain a Negative Vetting 1 (NV1) security clearance.

This selection process may be used to establish a merit pool. The pool might be accessed to fill ongoing and non-ongoing vacancies for similar roles in the Department over the next 18 months.

📌 Cyber Security Directors (Canberra)
🏢 Department of Employment and Workplace Relations (DEWR)
📍 Canberra