Senior Cyber Security Specialist

About the Role

The roles require substantial contemporary cyber security experience and broad knowledge across security governance, risk and assurance; enterprise and security architecture; cloud security; artificial intelligence and emerging technology risks; identity and privileged access; vulnerability and exposure management; monitoring and threat detection; incident governance and resilience; data protection; application and infrastructure security; accreditation; and Australian Government security requirements.

Primary Duties

• provide authoritative cyber security advice to the Director, Cyber, Risk and Assurance and the CIO/CISO on strategic, technical, operational, risk, threat, assurance and compliance matters
• support the Departments as the accountable risk owner by reviewing, interpreting and constructively challenging cyber security advice, evidence, reporting and recommendations
• lead or support cyber security risk assessments, control assessments, system security plans, security assessment reports, system authorisation packages, risk acceptance briefs, exemptions, improvement and remediation plans and other assurance artefacts
• assess the security implications of cloud services, artificial intelligence, automation and other emerging technologies, including security architecture, data protection, identity, access, logging, monitoring and control requirements
• provide cyber security advice on enterprise and solution architecture, secure-by-design proposals, identity and privileged access, applications, infrastructure, cloud, data protection and technology implementation decisions
• assess vulnerabilities, CVEs, vulnerability-scanning results, penetration-testing findings, threat information, control deficiencies and remediation proposals from a Departmentrisk and assurance perspective
• review logging, SIEM, monitoring, detection and other operational cyber information to identify material risks, evidence gaps and matters requiring escalation or further assurance
• provide security advice to ICT and cyber projects, procurements, business areas and system owners, including security requirements, design reviews, assurance planning, risk assessments and proportionate treatment options
• support the Departments organisational cyber incident governance role, including risk assessment, executive advice, coordination, escalation, communications, recovery priorities, lessons learned and assurance of the service-provider response
• review, update and improve the Departments cyber security policies, standards, procedures, templates, playbooks, reporting products and guidance
• interpret and apply the PSPF, ISM, Essential Eight (ASD Essentials) and other relevant ASD and Australian Government security guidance
• support the Departments responses to the ASD Cyber Security Survey and other compliance, assurance, audit and reporting requirements
• improve cyber risk registers, control libraries, assurance plans, compliance tracking, vulnerability registers and executive and committee reporting

Location and Contract Term

This role can be based in Canberra with Hybrid working arrangements

12 month contract with 2 x 12 month contract extension options pending budget and delegate approval.

Security Requirements

Applicants must be Australian Citizens and hold a NV1 security clearance.

Applications close 29 October.