Job Title – Cyber Security Adviser (GRC)

Client: Services Australia

Location: QLD, ACT, VIC, NSW, SA

Work Arrangement: Hybrid

Security Clearance: NV1

Contract Length: 12 months + 2 × 12-month extensions

Job details

Cyber Advisors provide ICT security advice and assistance to government, including policy creation, project advice and assistance, and research.

Cyber Security Advisers with Governance, Risk and Compliance (GRC) experience provide strategic and operational advice to ensure cyber security practices, controls and risk management activities are aligned with business objectives, government policy requirements and industry best practice

Cyber Security Advice specialists provide ICT security advice and assistance to the agency, delivering policy and/or project advice and research. Cyber Security Advisers deliver management, technical, governance and administrative services to implement security controls and security management strategies.

Cyber Security Advice manage security risk assessments to increase the practical application of security controls. Assistant Directors – Cyber Security Advice interpret and develop cyber security policies and procedures and contribute towards their implementation. Assistant Directors – Cyber Security Advice build stakeholder capability on cyber security standards and guidelines to increase compliance with security requirements.

Technical skills

- Governance, Risk and Compliance (GRC) platforms:
- Archer IRM or equivalent.
- Vulnerability management platforms:
- Rapid7
- Tenable
- Microsoft Defender
- Security monitoring and logging platforms:
- Security Information and Event Management (SIEM)
- Microsoft Sentinel or equivalent.
- Familiarity with network security, endpoint security and application security controls.
- Understanding of system accreditation, System Security Plans (SSPs) and security assessment processes.
- Identity and Access Management (IAM) concepts and technologies
- Cloud Platforms:
- Microsoft Azure
- Amazon Web Services (AWS)
- Google Cloud Platform (GCP).

Key duties and responsibilities

- Write, update, and maintain internal information security policies, guidelines, and procedures.
- Identify, assess, and prioritise information security and IT-related risks, determining how to mitigate or accept them.
- Prepare the organisation for internal and external audits by monitoring adherence to standards.




- Review third-party software and vendors to ensure they meet the organisation's security baseline.
- manage security risk assessments of relevant tools, websites, applications and processes to increase practical application of security controls
- manage security control activities and review information system designs for vulnerabilities and potential breaches in security operations and make recommendations for improvements
- manage risk assessments, business impact analysis and assurance of relevant tools, websites, applications and processes
- assess and resolve cyber security risks using appropriate mitigations and strategies
- develop, implement and review cyber security guidelines, standards and procedures
- support stakeholders to embed cyber security standards, policies and guidelines to increase compliance with security requirements and safeguard against security threats
- use technical and specialised knowledge to resolve and/or escalate highly sensitive and complex cyber security enquiries
- manage security administration activities and provide expert advice on security features and capabilities of ICT hardware and software products
- advocate for security awareness including risk management trends and appropriate strategies and mitigations
- manage the operations of a team including managing performance, resources and workflows and establish priorities to achieve results and business objectives
- act with integrity by promoting workplace practices aligned with the APS Values and the APS Code of Conduct
- exercise delegations in line with legislation and guidelines.

About the project Familiarity with vulnerability management systems such as Rapid7, Tenable, Archer, ForeScout or other vulnerability management experience is desirable.

Knowledge/Qualifications

- Cyber security knowledge and experience
- Protective Security Policy Framework (PSPF)
- Information Security Manual (ISM)
- Essential 8
- National Institute of Standards and Technology (NIST)
- Governance, Risk, and Compliance (GRC) knowledge in relation to cyber security.




- Information security SCTY - Level 5
- Specialist advice TECH - Level 5
- Methods and tools METL - Level 5
- Security operations SCAD - Level 4
- Performance management PEMT - Level 5
- Stakeholder relationship management RLMT - Level 5
- Desirable: ISACA - AI Security Training, AI Audit training

Criteria

Candidate must provide a one-page pitch to address all criteria specified. This is equal to 5000 characters (including spaces).

Essential criteria

- Demonstrated experience delivering cyber security uplift, cyber resilience, security remediation or compliance initiatives within large and complex ICT environments, preferably within Australian Government or other regulated environments.

- Demonstrated and proven experience performing the duties and responsibilities relevant to the role being applied for, including the required technical skills, technologies, frameworks and methodologies identified in the RFQ

- Demonstrated experience applying cyber security frameworks, policies and standards, including the Protective Security Policy Framework (PSPF), Information Security Manual (ISM), Essential Eight and other relevant security and risk management frameworks.

- Demonstrated ability to engage, influence and collaborate with a broad range of stakeholders, including senior executives, technical specialists, business representatives and external providers.

- Must hold and maintain a current Negative Vetting Level 1 (NV1) Security Clearance.

Desirable criteria

- Demonstrated experience delivering cyber security, infrastructure, ICT transformation or uplift activities within Services Australia or other Australian Government agencies.
- Demonstrated experience identifying, assessing and managing cyber security risks, vulnerabilities, compliance obligations and remediation activities.
- Experience working within large-scale enterprise environments involving cloud platforms, identity and access management, security operations, infrastructure, applications and data services.
- Demonstrated ability to deliver outcomes within tight timeframes while managing competing priorities, dependencies and stakeholder expectations. Demonstrated ability to communicate complex technical and cyber security concepts to both technical and non-technical audiences and contribute to capability uplift through mentoring, collaboration and knowledge transfer activities

📌 Cyber Security Adviser (GRC) (Australia)
🏢 Cavum Consulting
📍 Australia