Profectus is seeking an experienced Cyber Security Assessor with AI expertise to provide independent security assurance across a pipeline of AI projects within an Australian Government agency. This is an assurance role rather than an AI build role, assessing each project’s requirements, identifying the security risks of AI-enabled systems and advising project teams and risk owners so projects can progress through assessment and authorisation. The work covers AI threat and risk assessments, review of security documentation and evidence, support to AI testing and evaluation, and development of governance and assurance artefacts.

Key Responsibilities

- Assess AI project requirements to establish the security and assurance conditions each project must meet
- Conduct AI-specific threat and risk assessments covering models, data flows, hosting, integrations and supply chain
- Identify risks such as prompt injection, data poisoning, model and data leakage and insecure integration
- Review security documentation, architectures, controls and assurance evidence
- Support assessment and authorisation activities to help systems achieve Authority to Operate
- Contribute to AI testing and evaluation, including red teaming and validation of performance and security claims where required
- Develop and review use case assessments, model cards, system cards and assurance cases
- Provide evidence-based risk positions and reporting to project teams, system owners and risk owners
- Prepare written advice and briefings for senior decision makers
- Manage assessments across multiple concurrent projects to fixed delivery timeframes

Required Experience
- Experience providing cyber security assessment, assurance or ICT security risk advice within Defence or Australian Government environments




- Working knowledge of the Information Security Manual (ISM), the Defence Security Principles Framework (DSPF) and Defence assessment and authorisation processes leading to Authority to Operate
- Understanding of how LLMs, RAG and generative AI systems work and the security risks specific to them
- Experience reviewing security documentation, architectures, controls and assurance evidence
- Ability to translate findings into clear risk positions for technical and non-technical stakeholders
- Proven ability to manage multiple concurrent projects and meet fixed delivery timeframes
- Robust written and verbal communication skills, including preparing advice for senior decision makers

Desirable Experience
- Experience applying the Policy for the Responsible Use of AI in Government, ISO/IEC 42001 or the NIST AI Risk Management Framework
- Experience in AI test, evaluation, verification and validation (TEVV), AI red teaming or adversarial testing
- Familiarity with cloud AI platforms such as Azure AI or AWS AI/ML and their security controls
- Experience producing AI governance artefacts such as use case assessments, model cards, system cards and assurance cases
- Certifications such as CISSP, CISM, IRAP, or cloud AI or security certifications
- Tertiary qualification in cyber security, computer science, engineering, data science or a related discipline

Security Clearance Requirements
- Must be an Australian Citizen
- Must have a current AGSVA NV1 Security Clearance (minimum)

Working Arrangements
- Onsite
- Canberra
- Hybrid may be considered by exception

Why Profectus Profectus partners with Australian Government agencies to deliver trusted ICT capability across complex delivery programs. We take a long term, relationship driven approach, supporting our people across the full lifecycle of their engagement while contributing to outcomes of national importance.

📌 Cyber Security Assessor (Canberra)
🏢 Profectus
📍 Canberra