Lead Risk Assessor

About the Role and Responsibilities

We seek an experienced Lead Risk Assessor to join our Melbourne team to spearhead cyber security risk evaluations across diverse projects, programs, and technology initiatives. This senior position requires a professional adept at engaging with executive stakeholders, translating intricate technical security risks into understandable business language, and guiding sound organizational risk decisions.

In this role, you will oversee cyber security risk assessments throughout project lifecycles, collaborating closely with technology, security, project, and business units to identify, evaluate, and mitigate risks proactively. You will also play a pivotal part in enhancing the risk assessment function by refining methodologies, processes, documentation, governance, and stakeholder relationships.

Key Responsibilities

• Lead comprehensive cyber security risk assessments for projects, programs, and strategic initiatives.
• Identify security risks, evaluate their impact, and recommend suitable treatment options.
• Translate complex technical security issues into clear business risks for diverse audiences.
• Engage senior leadership and executive stakeholders to discuss findings and provide actionable recommendations.
• Facilitate decision-making around risk and support risk owners in informed choices.
• Collaborate with Agile and DevOps teams to integrate security risk practices into iterative delivery processes.
• Maintain and update risk registers, tracking treatment plans until resolution or formal acceptance.
• Develop and enhance risk assessment methodologies, standards, templates, and playbooks.
• Drive continuous improvements in team processes, documentation quality, and engagement with stakeholders.
• Contribute to governance, risk, and compliance (GRC) reporting, metrics, and overall continuous improvement initiatives.
• Keep abreast of evolving cyber threats, regulatory requirements, and industry best practices.

Essential Qualifications and Experience

• Over 8 years of professional experience, predominantly in cyber security risk, GRC, information security, or related fields.
• Proven leadership in conducting cyber security risk assessments within complex enterprise settings.
• Strong familiarity with recognized frameworks such as NIST, ISO 27001/31000, COSO, or equivalents.
• Demonstrated ability to communicate effectively with senior and executive stakeholders.
• In-depth understanding of risk governance, treatment, and decision-making processes.
• Experience working effectively within Agile and DevOps environments.
• Excellent verbal and written communication skills, capable of conveying technical risks in business terms.
• Strong stakeholder management, influencing abilities, analytical thinking, and critical judgment skills.
• Capability to work autonomously and make sound decisions amid uncertainty.

Highly Desirable Experience

• Exposure to wider risk management fields including Enterprise Risk, Operational Risk, GRC, Compliance, Internal Audit, and Technology Risk.
• Certifications such as CRISC, CISM, CISSP, ISO 27001 Lead Risk Manager or equivalents are advantageous.

Why Join Us?

This position offers the chance to play a vital role in defining how cyber security risks are assessed, communicated, governed, and managed throughout a complex organization, providing significant influence over security and business outcomes.