2 Principal Cyber Security Specialists

This Tender is invited by the Issuer. Overview The Department of Social Services (DSS) is seeking two Senior Cyber Security Specialists to join the Department's Cyber, Risk and Assurance function and to provide authoritative cyber security advice and senior delivery support to the Director, Cyber, Risk and Assurance and the Chief Information Officer, who is also the Department's Chief Information Security Officer and Artificial Intelligence, Accountable Official. About DSS operates through a managed service ICT model. Services Australia provides most managed ICT and operational cyber security capabilities, including cyber security operations, monitoring and detection, operational incident response, vulnerability and patch-management services, coordination of penetration testing and other security testing, and technical implementation of security controls expected in standard ICT and cyber security function. DSS nevertheless retains accountability for its cyber risks and outcomes and cannot transfer its responsibility for informed risk ownership, governance, assurance and decision making to Services Australia as its service provider. Purpose The specialists will strengthen DSS's internal cyber security function and its ability to understand, govern, direct and assure cyber security across a complex enterprise and managed service environment. They will operate on DSS's behalf as informed and technically credible cyber advisers by reviewing assurance evidence, constructively challenging advice, assessing risk, supporting decisions and providing advice on responsibilities that must remain with the Department. An important outcome of the engagement is sustainable internal capability while DSS rebuilds its APS cyber workforce. The Role The role includes: Reviewing assurance evidence, constructively challenging advice, assessing risk, supporting decisions and providing advice on responsibilities that must remain with the Department Examining complex technical and operational issues, identifying material security implications, and assessing whether controls, evidence and proposed treatments are credible Translating findings into practical advice for technical teams, system owners, executives and the Director, Cyber, Risk and Assurance and CIO/CISO/CAIO Working with limited supervision and delivering at pace across competing priorities, providing immediate expert capacity while DSS rebuilds its APS cyber workforce Working collaboratively with the EL2 Director, Cyber, Risk and Assurance, the DSS ICT Program Management Office, APS employees, business and system owners, project teams, Services Australia and other delivery partners, including key security agencies as required Mentoring APS employees, transferring knowledge, improving policies and processes, developing reusable artefacts and helping establish effective ways of working that reduce long term reliance on external resources Role Requirements Substantial contemporary cyber security experience and broad knowledge across security governance, risk and assurance; enterprise and security architecture; cloud security; artificial intelligence and emerging technology risks; identity and privileged access; vulnerability and exposure management; monitoring and threat detection; incident governance and resilience; data protection; application and infrastructure security; accreditation; and Australian Government security requirements Ability to examine complex technical and operational issues, identify material security implications, and assess whether controls, evidence and proposed treatments are credible; these are not compliance only, audit coordination or high level security documentation or review roles Sufficient technical credibility to interpret and challenge operational and architectural advice, vulnerability data, security testing outcomes, logging and monitoring information, incident advice and control evidence, although candidates are not expected to perform day-to-day cyber engineering, penetration testing or security operations Candidates may bring deeper expertise in enterprise cyber risk, assurance, accreditation, security policy and Australian Government security requirements, or in ITSA/CISO advisory, security architecture, cloud and AI security, vulnerability and threat assessment, incident governance and technical assurance All candidates must demonstrate sufficient breadth, judgement and technical credibility to operate effectively across the end-to-end cyber security domain within the Commonwealth Government ICT environment