ASD EL1 Technical Leads - Cyber Security Assessor, Supply Chain Security, IT Security Advice

Information Security Branch is part of the Australian Signals Directorate's Security, Finance and Property Division. Alongside Security and Integrity Branch, it delivers shared security services to ASD and the Defence Intelligence Agencies. The Branch protects ASD's electronic information, systems and people through integrated security advice, assessment, monitoring, response, assurance and capability services. 

IT Security is seeking to recruit for the following EL1 positions:

Assistant Technical Director - Lead Cyber Security Assessor 

• Lead resources, priorities and workflows for complex system security assessments.
• Lead lifecycle risk assessments, threat modelling, business impact analysis and control assessments.
• Analyse architectures, configurations and evidence to identify vulnerabilities, control gaps and systemic risks.
• Determine residual risk and treatments, producing authoritative assessment reports, briefs and decision records.
• Set evidence and review standards and define triggers for reassessment or escalation.
• Advise stakeholders, mentor practitioners and improve assessment policy, methods, tools and reporting.
• Canberra based only.

Technical Lead - Lead Supply Chain Security Specialist 

• Lead the cyber supply chain security function, resources, priorities and delivery.• Develop and improve supply chain security frameworks, processes, standards and reporting.
• Lead risk-based assessments and due diligence of suppliers, products, services and dependencies.
• Embed security requirements, assurance evidence and contractual protections into procurement.
• Advise decision-makers and establish lifecycle assurance for higher-risk suppliers and services.
• Identify systemic risks, drive organisational and supplier uplift, and represent ASD in relevant forums.
• Melbourne based only

Assistant Technical Director - Lead IT Security Advice Specialist 

• Lead and develop security practitioners and manage priorities, workflows and service quality.
• Provide authoritative lifecycle advice by translating legislation, the PSPF, ISM and ASD policy into practical outcomes.
• Lead risk analysis, coordinate stakeholders and resolve or escalate complex security issues.
• Oversee ICT security approvals and the IT Security Officer program, including decision records and secure asset handling.
• Develop and maintain security policy, guidance, templates and self-service resources.
• Develop, maintain and uplift organisational and specialist ICT security training and awareness.

Further information can be found at: I’m changing my career | Australian Signals Directorate (asd.gov.au)

ASD is seeking applicants to fill current and anticipated vacancies and to create a merit pool for future vacancies. In line with the Australian Public Service Commissioner’s Direction 2022, upon completion of the recruitment activity, the merit pool will be available to locations across Australia.

Candidates are not expected to demonstrate specialist expertise

• Strong and current expertise in at least one of the advertised disciplines: cyber security assessment and assurance, cyber supply chain security, or IT security advice. 
• Demonstrated ability to lead very complex cyber security work under broad direction, exercise sound independent judgement and remain accountable for the quality and timeliness of outcomes. 
• Ability to analyse relevant technical, threat, business, control and supplier information and convert it into clear, defensible risk positions and proportionate treatments. 
• A strong understanding of applicable legislation, Australian Government security frameworks and ASD policy, with the ability to apply policy intent pragmatically in complex operational environments. 
• Demonstrated ability to manage resources, priorities and workflows, respond to changing demands and continuously improve services, methods, standards and guidance. 
• Highly developed written and verbal communication skills, including the ability to explain complex technical, policy, commercial and risk matters to technical, non-technical and senior audiences. 
• Strong stakeholder engagement and influencing skills, with the confidence to challenge constructively, resolve competing priorities and build productive internal and external relationships. 
• A positive and inclusive leadership approach, with demonstrated ability to set clear expectations, assure quality, share expertise, coach and mentor staff and build team capability. 
• A commitment to professional development, collaboration and maintaining contemporary knowledge of cyber security threats, technologies, vulnerabilities and risk management practices. 

To be eligible for employment with ASD, you must meet all of the following eligibility criteria:

• Australian Citizenship - Applicants must be an Australian citizen. Only in exceptional circumstances can this requirement be waivered. 
• Organisational Suitability Assessment – The preferred applicant will be required to undergo an Organisational Suitability Assessment (see Organisational Assessment section).
• Security Clearance - It is a condition of employment that applicants are willing and able to obtain and maintain the requisite security clearance for the duration of their employment with ASD.
• Health Assessment - The preferred applicant may be required to undergo a medical examination conducted by the Agency’s preferred medical provider. 

Please ensure that you meet the eligibility requirements outlined in the Information Pack prior to submitting an application.

Desirable experience includes:

• Relevant tertiary qualifications, professional certifications or formal training in cyber security, ICT, information systems, risk management, procurement, supply chain management or a related discipline will be highly regarded.
• Substantial experience in at least one of the advertised disciplines: cyber security assessment and assurance, cyber supply chain security, or IT security advice.
• Practical experience applying Australian Government security frameworks, including the PSPF, ISM and relevant policies.
• Leading and quality-assuring complex cyber security risk assessments, advice, policy, standards or assurance activities.
• Translating technical, business, supplier and threat information into clear risk positions and proportionate treatments.
• Working collaboratively with technical, business, procurement, commercial, legal and governance stakeholders.
• Leading teams, managing competing priorities, mentoring staff and improving security services and practices.
• Working in classified, sensitive or mission-critical environments.

Candidates are not expected to hold qualifications or demonstrate specialist experience across all three disciplines.