Third Party Security Analyst

About the role

Bupa is hiring a Third Party Security Analyst in Melbourne on a permanent basis. The analyst partners with project teams that want to engage new vendors, helping them assess the information security capability of those vendors so that regulated entity information assets remain protected and new security risks are avoided.

Key responsibilities

• Carry out third-party security due diligence assessments to inform the business of each vendor's security exposure before contracts are signed.
• Run triage processes and security questionnaires to understand the supplier's security maturity and gaps, and evaluate the design of its information security controls.
• Report findings in a risk context, agree a remediation plan with internal stakeholders and the vendor, and monitor the vendor's attack surface.
• Oversee agreed remediations and validate them before closure.
• Support the Cyber Security Incident Response team with third-party incident response testing, simulations or real-world incidents where required.
• Work with security testing teams to coordinate regular controls testing, and prepare scheduled and ad-hoc reports on third-party security risk profiles, issues, trends and improvements.
• Support Security Risk Assessments and maintain Bupa's third-party assessments repository.

Required profile

• 2-4 years' experience in information security or a related field.
• Tertiary qualification in an information technology discipline or equivalent professional experience.
• Experience in an APRA- and/or PCI-regulated industry (preferred).
• Vendor and partner management experience, including professional services and technology vendors.
• Strong business and commercial acumen, excellent communication skills and teamwork in matrix structures.

Required skills

• Knowledge of security and risk frameworks such as ISO-27000, SABSA, CISSP and NIST.
• Technical documentation, report writing and presentation skills.