Cybersecurity Risk Director

About the role

In this position within the Risk, Group Technology team, you will act as a senior specialist providing Line 2 expert risk advice, oversight and judgement across the enterprise information‑security portfolio. The role shapes how material cyber‑risk is understood, challenged and communicated to the Board, Executive Committee and regulators.

Key responsibilities

• Provide independent Line 2 expertise on material information‑security risks, controls, remediation and risk acceptance, translating them into clear priorities and escalation paths.
• Refresh annual and in‑year material risk themes, informed by horizon‑scanning, stress‑testing and emerging threat analysis.
• Lead complex Line 2 review and challenge activities across cyber‑risk, controls, issues and remediation programmes, ensuring evidence‑based, traceable positions.
• Synthesise insights from incidents, reviews and assurance work to identify systemic weaknesses and recommend control uplift.
• Produce and present executive‑ready briefings, governance papers and risk narratives for senior leadership and board audiences.

Required profile

• Extensive senior‑level experience in information‑security operations, risk, compliance or assurance within a complex APRA‑regulated environment.
• Proven ability to form, articulate and defend independent views on control effectiveness, remediation credibility and residual risk for material matters.
• Strong understanding of APRA CPS 230 and CPS 234 requirements and experience engaging with auditors and regulators.
• Demonstrated capability to review and challenge risk‑in‑change for large technology, cloud or architecture initiatives.
• Excellent influencing and stakeholder‑management skills, able to operate credibly as a specialist advisor without direct authority.

Required skills

• NIST cybersecurity framework
• MITRE ATT&CK threat‑modeling
• APRA CPS 230 compliance
• APRA CPS 234 compliance
• Risk metrics interpretation (KRIs/KPIs, control maturity indicators)