Cyber Security, Risk & Governance Lead

About the role

A mining producer is seeking an experienced Cyber Security, Risk & Governance Lead to drive and mature its cyber security capability across corporate and operational technology environments. This is a strategic leadership role based in Perth with some site travel, focused on strengthening cyber governance, risk management, compliance and assurance while keeping security aligned to organisational objectives. The role works closely with technology teams, business leaders and external partners to build robust security frameworks and support ongoing cyber maturity initiatives.

Key responsibilities

• Define and maintain the organisation's cyber security direction, governance framework and risk management approach, acting as a trusted advisor to technical and business stakeholders.
• Develop and maintain the cyber security strategy, roadmap and continuous improvement program.
• Provide cyber security architecture, risk and assurance guidance for OT environments, industrial control systems and critical infrastructure.
• Lead cyber governance, including security policies, standards and procedures, and maintain risk registers and oversight of risk assessment, mitigation and reporting.
• Coordinate internal and external audits, control reviews and remediation, and manage relationships with managed security providers and specialist partners.
• Oversee identity and access management, privileged access controls and information protection, and contribute to vendor risk assessments and third-party assurance.
• Develop cyber metrics, dashboards and executive reporting, and support incident governance, post-incident reviews and data governance, privacy and responsible use of technology.

Required profile

• Minimum seven years' experience in cyber security, risk, governance, architecture or assurance roles.
• Experience developing security frameworks, policies, standards and risk management practices, and managing cyber audits, compliance and assurance programs.
• Experience in industrial, manufacturing, resources, OT or critical infrastructure environments.
• Ability to engage with executives, operational stakeholders and technical teams.

Required skills

• Understanding of corporate and OT security principles such as ISO 27001 and IEC 62443.
• Experience with frameworks such as SMB1001, ISO 27001, NIST CSF or similar.
• Sound knowledge of identity management, endpoint security, cloud security, network security and information protection.
• Desirable: CISSP, CISM, CRISC or equivalent; Microsoft Defender, Entra, Purview and Sentinel.

The role offers a high-impact position with exposure to executive stakeholders, a competitive remuneration package and long-term career growth. Applications are made through the recruiter, Peoplebank.