Control Manager - Privileged Access Management

Control Manager – Privileged Access Management

• You are a problem solver who thrives in ambiguity and enjoys challenges

• Opportunity to utilise both people and technical management skills 

• We are one of the best and most advanced Cyber Security teams in Australia

Your business

The Technology division delivers the Group's information technology and banking operation functions to ensure the highest levels of customer service through world-class process excellence and technology innovation. Cyber Security protects the bank and our customers from theft, loss and risk events through effective and proactive management of cyber security, privacy and operational risk.

We support our people with the flexibility to balance where work is done, with at least half your time each month connecting in the office. We also have many other flexible working options available including changing start and finish times, part-time arrangements and job share to name a few. Talk to us about how these arrangements might work for you. 

Your new team

The Cyber Controls Chapter Area plays a crucial function within the Group Security division, responsible for designing and deploying effective cyber control capabilities and driving continuous improvement of the Group's cyber risk profile.

The Privileged Access Management team, part of the Cyber Controls Chapter, manages core cyber security controls across the identity and access landscape.

Your impact and contribution

As Control Manager – Privileged Access Management, you’ll help design, implement, manage and govern cyber security controls that address identity risks across the Group.

Working across Cyber Security, Identity & Access Technology, Enterprise Architecture, Risk and Engineering, you’ll ensure controls continue to address the Group’s evolving risks and threat landscape.

Your responsibilities will include

• Support the uplift of privileged access management control, including associated policies, standards, and guidelines, to ensure they remain effective and aligned with the evolving threat landscape across diverse technological environments

• Actively support the ‘Go to Green’ initiative by helping technology teams address control weaknesses, manage issues and to strengthen the Group’s risk posture.

• Collaborate with teams including Security Engineering, Identity and Access Management, Line 1 and Line 2 Risk, and Technology Platform Owners to effectively manage material risks related to Privileged Access Management (PAM) control

• Provide operational oversight to ensure privileged accounts are discovered, inventoried and their usage is monitored in line with the identity and access management standard and PAM Guidelines

• Provide compliance reporting to ensure technology services remain compliant with IAM Standard and PAM guidelines

• Ensure PAM control aligns to internal operational risk framework (ORMF) and external regulatory obligations (e.g., APRA CPS 234, ISO 27001, Essential 8 etc.)

• Lead the closure of associated RiS issues by coordinating evidence collection, demonstrating control uplift and obtaining endorsement from applicable risk and assurance stakeholders.

• Participate in audit process and prioritise agreed findings into control backlog.

We are interested in people who:

We're looking for someone who enjoys solving new problems where there isn't an established playbook. You'll be comfortable working through ambiguity, influencing diverse stakeholders and translating emerging technology into effective governance and controls.

You'll bring:

• Experience in Cyber Security Controls, Cyber Security Risk, Identity and Access Management, or Technology Risk within a large, complex organisation.

• A foundational understanding of Identity and Access Management concepts, including authentication, authorisation, identity lifecycle management and privileged access management.

• A strong risk mindset, with the ability to translate technical concepts into practical control requirements, standards and risk outcomes.

• An interest in AI, Agentic AI and emerging identity-related threats, with a willingness to rapidly build domain expertise.

• Experience designing, assessing or uplifting cyber security controls and working through governance approval processes.

• Excellent stakeholder management and communication skills, with the ability to influence across technology, architecture, engineering and risk functions.

• The ability to work effectively in highly ambiguous environments, bringing structure and clarity to emerging problems while maintaining delivery momentum.