IT Security Consultant - Assurance

About the role

The IT Security team at MinterEllison is seeking an IT Security Consultant to lead technical security risk analysis and assurance activities across the firm’s technology environment. Reporting to the IT Security GRC Manager, you will work closely with IT Architecture, Operations, Procurement and external service providers to embed security by design.

Key responsibilities

• Conduct threat and risk assessments for new and existing systems, applications and AI solutions, delivering structured risk reports with remediation recommendations.
• Perform security architecture reviews against MinterEllison standards and frameworks such as ISO27001, ASD Essential 8 and NIST.
• Coordinate penetration testing activities, including scoping, third‑party management and remediation tracking.
• Respond to client questionnaires, audits, RFPs and maintain supply‑chain security risk registers.
• Support ISO27001 and other certification programmes, run quarterly privileged‑access and asset‑inventory audits, and contribute to the IT Security awareness programme.

Required profile

• At least 2 years of experience in information security or IT risk with hands‑on security assessments.
• Proven ability to apply recognised threat‑risk methodologies (e.g., STRIDE, OCTAVE, NIST RMF).
• Experience reviewing security architectures for cloud (Azure/M365) and hybrid environments.
• Familiarity with security frameworks such as ISO27001, SSAE16, APRA CPS234, ASD Essential 8 and NIST.
• Strong analytical, communication and organisational skills with a self‑starter attitude.

Required skills

• Threat and risk assessment methodologies (STRIDE, OCTAVE, NIST RMF)
• Security architecture review (Azure, Microsoft 365)
• Security frameworks (ISO27001, SSAE16, APRA CPS234, ASD Essential 8, NIST)
• Penetration testing coordination
• Supply‑chain security risk management