More than 5 years of hands-on experience in cybersecurity or information security roles, preferably including some time in a consulting or advisory capacity within a complex organisation or a Managed Services provider.
Direct exposure to GRC within the Australian Government, including knowledge of the IRAP assessment process and experience in developing the supporting documentation required to attain an Authority to Operate, such as the SSP-A, SSP, SRMP, IRP and CMP.
Practical knowledge of cybersecurity frameworks and standards. For example, familiarity with Australian government standards like the ISM, E8 and PSPF. Experience applying risk management frameworks and ensuring compliance with regulations is essential.
Demonstrated ability to conduct security risk assessments and compliance reviews. Comfortable mapping security controls to framework requirements, identifying gaps, and recommending remediation actions. Experience developing and maintaining risk assessment material, security policies, and/or audit documentation is essential.
Knowledge of Australian cybersecurity and privacy regulations (e.g. familiarity with the Australian Privacy Act and Notifiable Data Breaches scheme) is useful.
Bachelor’s degree in Cybersecurity, Computer Science, Information Systems, or a related field or equivalent work experience in a relevant discipline can be advantageous but not mandatory.
Professional security certifications are highly valued. Certifications such as CISM, CISA, CRISC, or ISO 27001 Lead Auditor/Implementer or similar security certifications demonstrate relevant expertise. Certifications like CISSP (or Associate of CISSP), CEH, OSCP, or relevant SANS GIAC certifications (e.g. GSEC, GCIH, GPEN) are a plus. Certification in cloud security (e.g. AWS Security Specialty, CCSP) or other specialised areas is also highly regarded.
While not mandatory, any awareness of the following international and industry standards or frameworks will be useful, while experience will be highly regarded:
o ISO/IEC 27001
Information Security Management System (ISMS), ISO/IEC 27002 Information Security Controls, ISO/IEC 31000 Risk Management
Principles and Guidelines, and ISO/IEC 27005 Information Security Risk Management.
o National Institute of Standards and Technology (NIST)
various risk, privacy, control, configuration and audit frameworks.
o ITIL practices for IT service management (ITSM), including security operations and incident management.
o Australian Prudential Regulation Authority (APRA CPS 234)
Information Security Standard.
o Australian Privacy Act 1988 and Notifiable Data Breaches (NDB) Scheme.
o PCI DSS (Payment Card Industry Data Security Standard).
o Open Web Application Security Project (OWASP).
o MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge).
o Common Vulnerability Scoring System (CVSS).
o Zero Trust Architecture (ZTA).
o Centre for Internet (CIS) Security Critical Security Controls.
o Cloud Security Alliance (CSA) Cloud Controls Matrix (CCM).