The System Risk Officer is a cyber security risk practitioner within the Bureau's Security Risk, Threat and Assessment team, reporting to the Manager Security Risk, Threat & Assessment/ Cyber Security Risk Lead. The role supports and conducts security assessments as part of the Bureau's System Authorisation process for recent systems and for existing systems requiring retrospective assessment, review or reauthorisation.

Working under broad direction and within established frameworks, procedures and priorities, the role progresses assigned components of security assessments from initiation through to findings and recommendations that inform System Authorisation decisions. It gathers and analyses business, technical and security information, reviews security control implementation and evidence, identifies issues and risks, and seeks guidance on complex, sensitive or novel matters.

The role works collaboratively with system managers, system owners, project teams, technical specialists and control owners to prepare and maintain the artefacts needed for security assessment and System Authorisation. These may include system descriptions, system security plans, security risk assessments, control evidence, treatment plans, assessment reports, findings and draft decision briefs for review by senior team members and the relevant authorising official.

The System Risk Officer may support liaison with external security assessors, including providers undertaking independent or IRAP-aligned assessments. The role assists with assessment planning, evidence collation and provision, clarification of findings, action tracking and stakeholder updates, escalating material risks, delays or information gaps to the Cyber Security Risk Lead or System Risk Adviser.





The successful candidate will bring developing knowledge of cyber security risk and system security assessment practices, sound analytical and written communication skills, attention to detail, and the ability to explain technical issues clearly. Familiarity with the Australian Government Information Security Manual (ISM), the Protective Security Policy Framework (PSPF) and related risk frameworks is desirable.

Experience supporting risk assessments involving artificial intelligence is also desirable but not essential.

- Support and conduct assigned security assessment activities as part of the System Authorisation process for new systems and existing systems undergoing retrospective assessment, review or reauthorisation, in accordance with Bureau governance, security policies and applicable Australian Government requirements.
- Gather, validate and analyse system, business and technical information to support assessment scoping, determine security control applicability, identify evidence requirements and highlight dependencies or information gaps.
- Prepare security and risk artefacts on behalf of system managers to support security assessment and System Authorisation, including system security documentation, cyber security risk assessments, control evidence summaries, treatment plans, assessment reports and draft decision briefs.




- Review security control implementation and evidence, identify potential control gaps and residual risks, and develop evidence-based findings and recommendations for review by senior team members.
- Work collaboratively with system managers, system owners, project teams, architects, technical specialists and control owners to obtain information, resolve routine issues and progress assigned assessment activities to agreed quality and timeframes.
- Support engagement with external security assessors, where required, including coordinating evidence requests, maintaining records, arranging clarification of findings and tracking agreed actions.
- Maintain accurate security assessment and System Authorisation records, registers, workplans and status information, and assist in monitoring conditions, actions and reauthorisation requirements for assigned systems.
- Provide clear and practical cyber security risk information within the scope of the role, tailored to technical and non-technical audiences, and promptly escalate significant, unresolved or complex matters.
- Contribute knowledge, lessons learned and improvement ideas to strengthen System Authorisation processes, templates, guidance and team practices.
- Undertake assigned ad hoc security risk activities arising from PSPF-related ICT requirements and directions, including supporting security risk assessments involving artificial intelligence systems or use cases.
- Comply with all Bureau work health and safety policies and procedures, and take reasonable care for your own health and safety and that of employees, contractors and visitors who may be affected by your conduct.

📌 System Risk Officer (Australia)
🏢 Bureau Of Meteorology
📍 Australia