IT Security, Governance & Risk Manager

Operating within a relatively small NZ business, but as part of a much larger regional organisation, this is a broad role spanning information security, governance, risk and protective security.

The organisation already has established security frameworks and capability. Your role will be to apply these within the New Zealand environment, interpreting local requirements including NZISM, PSR and PCDCC and turning them into practical, sustainable controls.

This is not a pure technical cyber role, nor a traditional corporate GRC position. You'll need to be comfortable operating somewhere between the two.

The role

You'll become a key point of contact for security governance and assurance in New Zealand, working across technology, operations, facilities, customers and senior leadership.

You'll be responsible for PCDCC assurance activities, security and risk assessments, policies and controls, personnel security, remediation programs, audit readiness and engagement with customers, assessors and government stakeholders.

At its heart, the role is about interpreting security requirements and turning them into action.

About you

We're looking for an experienced security, risk or assurance professional with knowledge of NZISM and PSR. PCDCC exposure would be highly regarded, alongside experience with ISO 27001, NIST or Essential Eight.

More importantly, you'll bring judgement, critical thinking and strong influencing skills. You'll understand the intent behind security requirements, assess risk pragmatically and communicate effectively with everyone from technical specialists to senior executives.

Experience within critical infrastructure, technology, telecommunications, cloud, data centres or another regulated commercial environment would be particularly relevant.

A technical grounding in IT infrastructure, systems or networks would also be highly regarded.

Eligibility to obtain the required New Zealand Government security clearance is mandatory.