Director - Cyber Defend and Operate

About the role

Grant Thornton Australia is looking for a self-starting, commercially astute Director to lead its cyber defend and operations capability as it evolves for an AI-enabled threat world. The role shapes a locally relevant, globally connected capability spanning advisory, implementation and managed service outcomes, and sits in a hands-on leadership position with career progression.

Key responsibilities

• Lead the local evolution of the cyber defend and operations capability, adapting global methods and expertise to the Australian market.
• Work directly with clients to understand their environment, threat landscape, operating model and risk tolerance, then advise on suitable cyber defence and operations models.
• Help shape advisory recommendations, implementation pathways, use cases, detection engineering, triage, response workflows and service improvement.
• Own the service roadmap, onboarding experience and customer journey, making the capability scalable and differentiated.
• Influence how AI-enabled threats, automation and analyst workflows shape service design, go-to-market strategy and commercial models.
• Work within a global network of cyber defence professionals while developing a locally differentiated offering.
• Lead and grow a team of security operations professionals, responsible for their development and progression.
• Advise executives and boards on detection and response, and act as a senior escalation point for major client incidents and complex delivery decisions.
• Hold senior client relationships, identify opportunities across advisory, implementation and managed operations, and contribute to sales enablement and recurring revenue growth.

Required profile

• Leadership experience in a security operations centre, managed detection and response, cyber defence operations or similar capability, in-house or as a service provider.
• Experience materially evolving a cyber defence, detection and response operating model, team or client-facing service.
• Experience working with clients or stakeholders outside your own organisation.
• A track record of leading and developing teams.
• Commercial awareness of how managed detection and response services are positioned, priced, sold, renewed and delivered.
• Experience with technology partners, alliances or global capability teams.
• Confidence in front of clients and comfort working in a team.
• Australian citizenship or permanent residency, and willingness to travel for client work.

Required skills

• Deep knowledge of cyber defence and operations: operating models, detection coverage, response playbooks, escalation pathways, service metrics and continuous improvement.
• Experience with modern SOC platforms and tooling; exposure to CrowdStrike, Microsoft Defender, Palo Alto or similar is beneficial.
• Nice to have: regulated or critical infrastructure experience (SOCI Act, APRA CPS 234, ISM), tabletop exercise or crisis simulation experience, purple team or threat-led testing, and certifications such as CISSP, CISM, GCIA or GCIH.

What we offer

• Permanent, full-time role with excellent career progression.
• 9-day fortnight with no salary reduction.
• Fully funded gym membership.
• Mental health support, financial and wellbeing coaching.
• Flexible working options.