Cybersecurity Consultant

Summary

Join Datacom as a Cybersecurity Consultant specializing in Governance, Risk, and Compliance (GRC). You will strengthen Datacom's customers' security posture by aligning security measures with business goals, ensuring compliance with Australian cybersecurity standards and regulations. Responsibilities include security consulting, stakeholder collaboration, project delivery, continuous improvement, communication and reporting, risk assessments, compliance and audits, and policy development. The ideal candidate possesses 3–5 years of cybersecurity experience, preferably in consulting, and a strong understanding of Australian cybersecurity regulations. A bachelor's degree and professional security certifications are highly valued. Datacom offers a range of perks, including social events, chill-out spaces, remote working, flexi-hours, and professional development courses.

Requirements

• 3–5 years of hands-on experience in cybersecurity or information security roles, preferably including some time in a consulting or advisory capacity with large organisations is highly desirable
• Australian citizenship and the ability to obtain a minimum Australian Government security clearance of Baseline Vetting (or higher) is needed to work on government customer projects
• Practical knowledge of cybersecurity frameworks and standards. For example, familiarity with Australian government standards like the ISM, E8 and PSPF. Experience applying risk management frameworks and ensuring compliance with regulations is highly regarded
• Demonstrated ability to conduct security risk assessments and compliance reviews. Comfortable mapping security controls to framework requirements, identifying gaps, and recommending remediation actions. Experience developing and maintaining risk assessment material, security policies, and/or audit documentation essential
• Strong analytical and problem-solving capabilities with keen attention to detail. Proactive in troubleshooting security issues and adept at finding creative, practical solutions. Ability to handle multiple priorities and work under pressure during security incidents or project deadlines
• Excellent written and verbal communication skills are essential. Able to translate technical security findings into clear, non-technical language for business leaders or customers. Strong interpersonal skills to work effectively with various Datacom or customers stakeholders, build consensus on security measures, and mentor junior team members

Responsibilities

• Act as a trusted advisor to Datacom’s customers and internal stakeholders, understanding their cybersecurity needs and providing expert guidance and security solutions
• Collaborate with cross functional teams to ensure a shared understanding of security risks and propose fit for purpose mitigations. This may include working closely with project managers, technical support teams, architects, third party vendors, developers, security teams and business units to integrate security requirements into projects or business as usual (BAU) tasks
• Support the planning and delivery of security projects or Datacom’s engagements, ensuring outcomes are achieved on time and meet quality standards. Maintain documentation of activities and track progress against project goals
• Stay up to date with the latest cyber threats, vulnerabilities, and best practices. Proactively recommend improvements to security policies, processes and tools to enhance overall security posture
• Prepare clear reports and presentations on security findings and recommendations. Communicate technical information to both technical and non-technical audiences (e.g. executives or customers) in an understandable manner, to facilitate informed decision-making
• Conduct comprehensive cybersecurity risk assessments and business impact analyses to identify vulnerabilities and evaluate potential threats. Develop risk artefacts such as plans, reports or registers and create roadmaps for safeguarding critical assets based on assessment findings
• Undertake compliance assessments against relevant standards, frameworks and regulations (e.g. ISM, PSPF or ISO 27001/27002). Ensure the organisation meets requirements of frameworks and industry-specific regulations. Prepare for and support internal (Datacom) and external (IRAP or ANAO) audits, addressing any compliance gaps identified
• Develop and update security policies, plans, standards, and procedures aligned with best practices and regulatory requirements. This includes authoring cybersecurity policy documents and process improvement artefacts to strengthen governance. Ensure that policies reflect frameworks and are communicated effectively across the organisation
• Contribute to the creation of tailored cybersecurity strategies and governance frameworks that align with Datacom or the customers’ unique business objectives and risk appetite. Provide advice to senior management on implementing security controls and risk treatments in a pragmatic, business-aligned manner

Preferred Qualifications

• Working in roles with direct exposure to GRC within the Australian Government will be a distinct advantage, but not mandatory
• Bachelor’s degree in Cybersecurity, Computer Science, Information Systems, or a related field or equivalent work experience in a relevant discipline can be advantageous but not mandatory
• Professional security certifications are highly valued. Certifications such as CAP, CISM, CISA, CRISC, or ISO 27001 Lead Auditor/Implementer or similar security certifications demonstrate relevant expertise. Certifications like CISSP (or Associate of CISSP), CEH, OSCP, or relevant SANS GIAC certifications (e.g. GSEC, GCIH, GPEN) are a plus. Certification in cloud security (e.g. AWS Security Specialty, CCSP) or other specialised areas is also highly regarded
• Knowledge of Australian cybersecurity and privacy regulations (e.g. familiarity with the Australian Privacy Act and Notifiable Data Breaches scheme) is useful
• ISO/IEC 27001 - Information Security Management System (ISMS), ISO/IEC 27002 Information Security Controls, ISO/IEC 31000 Risk Management - Principles and Guidelines, and ISO/IEC 27005 Information Security Risk Management
• National Institute of Standards and Technology (NIST) - various risk, privacy, control, configuration and audit frameworks
• ITIL practices for IT service management (ITSM), including security operations and incident management
• Australian Prudential Regulation Authority (APRA CPS 234) - Information Security Standard
• Australian Privacy Act 1988 and Notifiable Data Breaches (NDB) Scheme
• PCI DSS (Payment Card Industry Data Security Standard)
• Open Web Application Security Project (OWASP)
• MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge)
• Common Vulnerability Scoring System (CVSS)
• Zero Trust Architecture (ZTA)
• Centre for Internet (CIS) Security Critical Security Controls
• Cloud Security Alliance (CSA) Cloud Controls Matrix (CCM)

Benefits

• Social events
• Chill-out spaces
• Remote working
• Flexi-hours
• Professional development courses