The Third-party Risk Adviser is a security practitioner in the Security Risk, Threat and Assessment team. Reporting to the Security Risk Lead, the role supports the Bureau to identify and address security risks associated with third parties throughout the third-party relationship lifecycle. Third parties may include partners, consultants, vendors, service providers and suppliers engaged through procurement, outsourcing, contracts, partnerships and collaborations, including academic collaborations.

The role conducts new, periodic and event-driven third-party security risk assessments, including vendor and supply chain risk assessments and Foreign Ownership, Control or Influence (FOCI) risk assessments. It analyses jurisdictional, governance, privacy and protective security risks; assesses the source, reliability and integrity of providers and supply chains; and provides evidence-based advice on whether identified risks can be treated to an acceptable level.

The adviser works with procurement teams, contract managers, business owners, project and program areas, researchers, ICT, Legal and other security stakeholders to embed proportionate security requirements into procurement and contractual arrangements. The role maintains the third-party risk management register and monitors security treatments, contractual security obligations, provider compliance and reassessment triggers across the life of an arrangement, including completion or termination.

The Third-party Risk Adviser is a security practitioner in the Security Risk, Threat and Assessment team. Reporting to the Security Risk Lead, the role supports the Bureau to identify and address security risks associated with third parties throughout the third-party relationship lifecycle. Third parties may include partners, consultants,



vendors, service providers and suppliers engaged through procurement, outsourcing, contracts, partnerships and collaborations, including academic collaborations.

The role conducts new, periodic and event-driven third-party security risk assessments, including vendor and supply chain risk assessments and Foreign Ownership, Control or Influence (FOCI) risk assessments. It analyses jurisdictional, governance, privacy and protective security risks; assesses the source, reliability and integrity of providers and supply chains; and provides evidence-based advice on whether identified risks can be treated to an acceptable level.

The adviser works with procurement teams, contract managers, business owners, project and program areas, researchers, ICT, Legal and other security stakeholders to embed proportionate security requirements into procurement and contractual arrangements. The role maintains the third-party risk management register and monitors security treatments, contractual security obligations, provider compliance and reassessment triggers across the life of an arrangement, including completion or termination.

The key duties of the position include:

- Conduct recent, periodic and event-driven third-party security risk assessments across the third-party relationship lifecycle, from early procurement planning and provider selection through contracting, service delivery, change,



renewal, completion and termination.
- Conduct FOCI risk assessments for procurement and contract decisions, analysing ownership, control, governance, influence, foreign jurisdiction and data-access considerations, and reassessing risks when developments during the contract period may give rise to new or changed FOCI risks.
- Assess whether proposed third parties, products and services are secure and verifiable and whether identified security risks can be mitigated to a reasonable and acceptable level; document the basis for advice and escalte unacceptable or unquantifiable risks and proposed residual-risk decisions to the appropriate authority.
- Advise procurement teams, contract managers and business owners on proportionate security terms and conditions, including relevant PSPF obligations, subcontractor requirements, security incident notification and cooperation obligations, ongoing assurance, information and resource protections, and completion or termination arrangements.
- Review third-party assurance evidence, including relevant certifications, attestations, security assessments and IRAP assessment reports where applicable, and identify gaps, limitations, risks and required treatments.
- Support contract managers to monitor and review whether specified security controls, terms and conditions are implemented, operated and maintained by contracted providers and subcontractors over the life of the contract, and follow up or escalte non-compliance.
- Manage the third-party risk management register as an accurate and auditable record of third parties, assessments, FOCI considerations, vendor and supply chain risks, risk owners, decisions, residual risks, secur

📌 60019889 (Sydney)
🏢 Bureau Of Meteorology
📍 Sydney