Information Security Manager, Scams

About the role

AFCA is preparing to deliver a world-first external dispute resolution scheme under the Scams Prevention Framework, giving Australians an independent way to resolve scam-related complaints across banking, telecommunications and digital platforms. It is looking for an experienced Information Security Manager to design and implement the information security, governance and information management controls supporting this new function. Reporting to the Chief Information Security Officer, the role assesses AFCA's capability to securely receive, handle, store, classify and share sensitive scams-related information, working with Technology, Legal, Risk, Privacy, Data Governance and business stakeholders. It is a 12-month maximum-term contract.

Key responsibilities

• Assess current information security and information management capabilities across the Scams EDR Program and identify gaps in systems, processes, controls and information handling.
• Develop and deliver security uplift recommendations and implementation roadmaps, and support the design of secure information handling, classification and lifecycle management practices.
• Partner with Privacy, Data Governance, Records Management, Technology Governance and Risk teams to strengthen security controls.
• Advise on document classification, access controls, secure information sharing and information governance.
• Support assurance activities, control reviews, audits and evidence gathering, and create security assessments, guidance materials, procedures and executive reports.
• Drive awareness and capability uplift across teams handling sensitive scams-related information.

Required profile

• Demonstrated experience in information security, information governance, cyber risk, security assurance or secure information handling, including assessing controls and recommending uplift.
• Experience coordinating security requirements across multiple capability owners without duplication.
• Experience in information management, including records and document management, metadata, retention and disposal, and implementing improvements across business and technology functions.
• Strong written communication, sound judgement and discretion with sensitive information, and ability to work in a developing program environment.
• Desirable: experience in government, regulatory, intelligence, law enforcement, financial crime or cyber security environments, familiarity with Australian Government protective security expectations, and relevant certifications.

Required skills

• Familiarity with Microsoft 365 / SharePoint, DLP, access control, audit logging and document-management patterns.
• Desirable: enterprise data classification tooling, information governance platforms and DLP implementation.

What we offer

• Hybrid working with two days a week in the offices.
• Flexible leave options, including public holidays, gender affirmation leave, women's health leave and bonus paid time off after the year-end holiday period.
• A Gold AWEI Accredited workplace and an accredited family-friendly workplace.