Information Security Manager

About the role

The Information Security Manager leads the development, implementation and ongoing management of the information security program for ANZ Staff Super, ensuring compliance with CPS 234 and alignment with broader information security good practice. The role advises on secure operations across internal and outsourced environments, acts as the main contact for cyber and data protection matters and engages with the CISOs of major third-party service providers. It sits within the R&P Superannuation division, at 833 Collins Street, Docklands, Melbourne.

Key responsibilities

• Design, implement and maintain the Information Security Management Framework aligned to CPS 234, ISO 27001 and NIST, and lead compliance improvement including awareness training
• Assess the impact of evolving threats and regulatory requirements and support CPS 230 and FAR compliance
• Contribute to service provider contract reviews, assess their security controls and act as the main contact with service provider CISOs
• Conduct or coordinate security risk assessments, threat analysis and vulnerability reviews, and oversee treatment plans
• Lead the cybersecurity incident response plan, including incident management and reporting
• Provide risk-based advice on secure operations and report to the executive team and Board on risks, assurance gaps and maturity plans
• Build relationships with Line 1 and Line 2 Risk teams, specialist teams and internal and external audit

Required profile

• Proven information security or cyber risk management experience in an APRA-regulated environment, including oversight of third-party service provider risk
• Experience in or alongside a large, mature IT or risk governance structure, such as a financial services group
• Relevant qualifications preferred (e.g. CISSP, CISM, CRISC, CISA or ISO 27001 Lead Implementer)

Required skills

• Strong knowledge of CPS 234, ISO 27001, NIST CSF or similar frameworks and the regulatory and risk environment
• Experience defining and delivering an information security or technology assurance strategy, with a background in technology risk, assurance, audit or compliance
• Deep understanding of technology and security control environments and risks, with strong controls framework and security architecture experience
• Excellent communication skills, able to explain technical risks in plain language to non-technical stakeholders

The role is a 12-month fixed-term position, 40 hours per week. Applications are made through the ANZ careers site using reference number 127081.