Job Purpose
Responsible to establish, maintain and monitor cybersecurity compliance and governance programs across IT and OT, ensuring the organisation is well-prepared as a National Critical Information Infrastructure (NCII) entity and remains compliant with the APAD Code of Practice, NACSA Baseline Security Requirements, the upcoming PCI DSS obligations (including the open payment system landscape).
Key Accountabilities
- Accountable for sustained compliance with NCII obligations, APAD Code of Practice, NACSA Baseline Security Requirements, and PCI DSS (including open payment systems), ensuring requirements are translated into effective and measurable controls.
- Establishes and maintains the cybersecurity governance framework across IT and OT environments, ensuring policies, standards, and control objectives are consistently implemented and enforced enterprise-wide.
- Ensures continuous NCII readiness and successful regulatory and audit outcomes by maintaining audit-ready documentation, evidence, and demonstrable control effectiveness.
- Identifies, assesses, and monitors cybersecurity compliance risks across IT and OT, prioritising remediation actions and ensuring timely closure of findings and control gaps.
- Governs PCI DSS compliance across payment platforms, embedding cybersecurity controls into open payment initiatives and maintaining them throughout the system lifecycle.
- Provides regular, accurate reporting to immediate supervisor on compliance posture, NCII readiness, key risks, and remediation status to support informed decision-making and executive assurance.
- Drives ongoing improvement of cybersecurity governance and compliance maturity by monitoring regulatory changes, strengthening controls, and embedding best practices across the organisation.
- Embeds security controls into IT, network, and cloud infrastructure projects through close collaboration with technical teams, maintains accurate documentation of security procedures and investigations, and provides input into security policies and architecture decisions to support secure and reliable operations.
Qualifications, Skills & Knowledge
- Bachelor's Degree in Cybersecurity, Information Technology, or equivalent.
- Minimum 3 years of working experience.
- SIEM (e.g., Microsoft Sentinel, Splunk, QRadar), WAF, endpoint protection, vulnerability scanners (e.g., Nessus, Qualys), DLP, antivirus/malware protection.
