Cyber Security Governance Analyst

Shadow IT Identification & Risk Assessment

• Support the identification and analysis of Shadow IT, Business-Managed IT solutions and 3rd Party-Mandated solutions across QBE.
• Conduct risk assessments of identified applications, platforms and services.
• Evaluate technology solutions against control requirements and governance frameworks.
• Review supporting documentation, authoritative sources and operational processes to assess risk exposure.
• Identify, document and communicate identified technology risks, control gaps and remediation recommendations.
• Support the maintenance of Shadow IT inventories and associated risk registers.
• Track remediation activities throughout the lifecycle to ensure status is updated along the way and identified applications, platforms and services are moved to appropriate state.

Governance, Compliance & Oversight

• Support the development, implementation and maintenance of QBE's Shadow IT governance framework, processes and standards.
• Monitor compliance with governance requirements and minimum control standards.
• Coordinate periodic reviews and re-assessments of identified solutions to ensure ongoing compliance.
• Assist in providing information needed to document policy exceptions, risk acceptances and governance approvals.
• Support governance forums by preparing reporting, metrics and risk summaries.
• Track and report on remediation activities and governance outcomes.
• Contribute to the development and maintenance of governance documentation, standards and operating procedures.

Stakeholder Engagement & Advisory

• Partner with business and IT stakeholders to understand technology usage and support risk-informed decision making.
• Provide guidance on Business-Managed IT and 3rd Party-Mandated governance requirements, risk management expectations and security controls.
• Support business teams through onboarding, review and governance approval processes.
• Collaborate with Technology, Cyber Security, Risk, Privacy, Compliance and Procurement teams to address identified risks and control gaps.
• Assist in raising awareness of Shadow IT risks and governance requirements across the organisation.
• Support workshops, assessments and stakeholder engagement activities relating to Shadow IT governance.

Reporting & Data Analysis

• Maintain governance dashboards, inventories and reporting related to Shadow IT, Business-Managed IT and 3rd Party-Mandated technology risks.
• Analyse trends, emerging risks and recurring governance issues to identify improvement opportunities.
• Prepare reports, presentations and risk summaries for governance committees and leadership stakeholders.
• Monitor key risk indicators, compliance metrics and management actions.
• Support internal audit, regulatory and assurance activities relating to Shadow IT governance processes.

Continuous Improvement & Capability Development

• Contribute to the ongoing enhancement of QBE's Shadow IT governance capability, processes and tooling.
• Identify opportunities to improve governance efficiency, automation and user experience.
• Assist with the development of guidance materials, training content and awareness initiatives.
• Support process reviews to ensure governance frameworks remain effective, scalable and aligned to business needs.
• Monitor industry trends, regulatory developments and emerging risks associated with business-managed technology solutions.
• Contribute to initiatives that strengthen cyber risk management, technology governance and operational resilience.

---

About You

To be successful in this role, you will demonstrate:

• Experience in Cyber Security, Information Security, Technology Risk, IT Governance, Operational Risk or a related discipline.
• Experience supporting risk assessments, governance activities or compliance programs.
• Understanding of cybersecurity risk management principles and governance practices.
• Knowledge of information security frameworks and standards such as ISO 27001, NIST CSF, COBIT or related frameworks.
• Ability to assess risk and translate technical concepts into clear business outcomes.
• Strong analytical and problem-solving skills with excellent attention to detail.
• Ability to manage multiple activities and priorities in a structured and organized manner.
• Strong written and verbal communication skills.
• Effective stakeholder engagement skills and the ability to work collaboratively across business and technology teams.
• Experience preparing reports, metrics, governance documentation and risk summaries.
• A proactive mindset with a strong focus on continuous improvement.
• A collaborative and customer-focused approach to delivering outcomes.

---

Preferred Qualifications

• Degree in Cyber Security, Information Technology, Risk Management, Business, Governance or a related discipline.
• Professional certifications such as Security+, CISA, CRISC, CGRC, COBIT Foundation, ISO 27001 Foundation or equivalent.
• Experience working within regulated industries such as insurance, financial services or banking.
• Experience supporting technology governance, Shadow IT, SaaS governance, operational risk or compliance programs.
• Experience working with governance, risk and compliance (GRC) platforms, workflow tools or technology inventory solutions.
• Familiarity with cloud technologies, SaaS platforms and modern business application environments.

Key Focus Areas of the Role

• Shadow IT discovery and assessment
• Business-Managed IT and 3rd Party-Mandated governance
• Compliance monitoring and reporting
• Risk identification and remediation tracking
• Stakeholder engagement and advisory
• Governance framework development and continuous improvement