Team Leader, Security Governance, Risk & Reporting

• Permanent Full Time
• From $166k package
• Footscray location | hybrid work model

About Greater Western Water

We’re water… and more.

GWW is a Victorian government owned water corporation that provides an essential service to some of the fastest-growing communities in Australia, stretching from Melbourne’s CBD to Lancefield in the north and Bacchus Marsh in the west. Click here to learn more

Benefits

• We embrace flexibility and connection with a balance of on-site and WFH
• Free onsite parking (subject to availability)
• Gender neutral, 16-week parental leave available from commencement
• Eligible full-time employees may access additional Work Life Balance Days, subject to eligibility criteria, helping you prioritise wellbeing and flexibility.
• Free income protection and salary continuance insurance
• Access to corporate health insurance deals with major providers
• Wellbeing, prayer, and sensory rooms in the Footscray and Sunbury office

The opportunity

This is a unique opportunity to lead and shape the cyber security governance, risk and reporting function at GWW, playing a critical role in protecting the organisation’s digital and operational environments. As a key member of the Security leadership team, you will drive cyber security strategy through governance, risk management, compliance, assurance, awareness and reporting initiatives that strengthen organisational resilience. Leading a high-performing team, you will partner with technology, operational and business leaders to embed security-by-design principles, enhance cyber security maturity and foster a strong security culture across the organisation. This highly visible role offers the chance to influence cyber security decisions, provide trusted advice to senior stakeholders and regulators, and champion continuous improvement in a complex and evolving cyber security landscape.

Responsibilities

• Lead the development, implementation and continuous improvement of GWW’s cyber security governance framework, ensuring policies, standards, procedures and controls remain effective and aligned to business objectives and regulatory requirements.
• Oversee the identification, assessment, treatment and monitoring of cyber security risks across information technology, operational technology, information assets and third-party environments.
• Drive cyber security compliance and assurance activities, including audits, security assessments and regulatory obligations, ensuring findings and remediation actions are successfully delivered.
• Develop and deliver meaningful cyber security reporting, metrics and dashboards to provide insights on risk, compliance, maturity and performance to executive leaders, committees and the Board.
• Champion cyber security awareness, education and behavioural change initiatives that strengthen security culture and reduce human-related cyber risk across the organisation.
• Lead security assurance and control management activities, ensuring controls remain effective, fit for purpose and continuously improved to address emerging risks.
• Build, coach and develop a high-performing Security Governance, Risk & Reporting team, fostering capability growth, collaboration and a customer-focused culture.
• Partner with business, technology and operational leaders to provide trusted advice, embed security-by-design principles, and drive continuous improvement in cyber security maturity and organisational resilience.

Skills & Experience

• Significant experience in cyber security governance, risk, compliance and assurance, preferably within a critical infrastructure, essential services or highly regulated environment.
• Demonstrated experience implementing and operationalising the NIST Cybersecurity Framework (NIST CSF), Victorian Protective Data Security Standards (VPDSS) and Payment Card Industry Data Security Standard (PCIDSS) including maturity assessments, gap analysis, risk-based improvement planning and security governance.
• Strong knowledge and practical experience with the Security of Critical Infrastructure Act 2018 (SOCI Act) and Critical Infrastructure Risk Management Program (CIRMP) obligations, including enhanced cyber security obligations applicable to critical infrastructure.
• Strong experience in cyber security risk and assurance, including cyber risk assessments, risk registers, control effectiveness, audits, compliance reviews, remediation programs and third-party security risks.
• Demonstrated ability to lead security governance and communicate cyber risk, including security metrics, KRIs, maturity reporting, regulatory compliance and strategic improvement roadmaps.

See yourself thrive

Our vision for GWW is Thriving People and Country. We aim to be as diverse as the communities we serve and are deeply committed to building a workplace where everybody thrives. We’re supportive, inclusive, and friendly, and value everyone for who they are and what they can bring.  

We’re seeking applicants across all cultural backgrounds, genders, and abilities, and will make reasonable adjustments as required, so please talk to us about what you need.

Don’t meet every single requirement? If you’re excited about this role, we encourage you to apply.

Don’t delay your application, include your resume, and cover letter (no more than 1 page), shortlisting will commence early!

The successful candidate will be required to complete pre-employment checks, including reference checks, medical assessments, a national police check, and verification of working rights in Australia.

Please note: this role has been classified as a Critical Worker under the Security of Critical Infrastructure (SOCI) Act and GWW’s Critical Infrastructure Risk Management Program. As such, the successful candidate will also be required to undergo additional security clearance checks in line with legislative obligations.

Applications close: Sunday 15 November