Information Security Manager

About Us

At ANZ, we're shaping a world where people and communities thrive, driven by a common goal: to improve the financial wellbeing and sustainability of our millions of customers.

About the Role

This role is responsible for leading the development, implementation, and ongoing management of the information security program for ANZ Staff Super, to ensure compliance with CPS 234 and alignment with broader information security good practice.

The Information Security Manager provides expert advice and supports secure operations across internal and outsourced environments. The role acts as the organisation’s primary contact for cyber and data protection matters, including active engagement with the CISOs of major third-party service providers. It supports the executive team by translating technical risks into business impacts and developing actionable plans to proactively protect members’ data.

Role Type: 12 Months Fixed Term

Role Location: 833 Collins Street, Docklands VIC 3008

Work Hours: 40 Hours/Week

What will your day look like?

This role is accountable for:

Framework and compliance

• Design, implement and maintain the Information Security Management Framework, aligned to CPS 234, ISO 27001 and NIST
• Lead activities to improve compliance with information security policies, including targeted awareness training
• Stay across evolving threats and regulatory requirements, assess their impact and drive change
• Support CPS 230 (operational risk management) and Financial Accountability Regime (FAR) compliance by assuring accountable persons on information security risks and controls

Service provider oversight

• Contribute to service provider contract reviews, ensuring information security obligations are included
• Assess the design and operating effectiveness of service providers' security controls against agreed standards
• Act as the main contact for security matters with service providers' CISOs and internal security stakeholders

Risk assessment and incident response

• Conduct or coordinate security risk assessments, threat analysis and vulnerability reviews, and recommend and oversee treatment plans
• Assess assurance reports, penetration testing results and incident response readiness

• Lead ANZ Staff Super's cybersecurity incident response plan, including incident management and reporting, to ensure timely, compliant responses

Advice, reporting and stakeholders

• Provide risk-based advice on secure operations, including communication channels, data handling and workflow design
• Report clearly to the executive team and Board on the threat landscape, security risks, assurance gaps and security maturity uplift plans

Build trusted relationships with Line 1 and Line 2 Risk teams, ANZ specialist teams, and internal and external audit

What will you bring?

To be successful in this role, you will ideally bring the following:

• Proven information security or cyber risk management experience in an APRA regulated environment, including oversight of third-party service provider risk
• Strong knowledge of CPS 234, ISO 27001, NIST CSF or similar frameworks, and of the regulatory and risk environment, including emerging threats and better practice
• Experience in or alongside a large, mature IT or risk governance structure, such as a financial services group

• Excellent communication skills, using plain language for non-technical stakeholders, bridging business and technical discussions and influencing decisions

You will also possess the following skills and experience

• Experience defining and delivering an information security or technology assurance strategy, with a background in technology risk, assurance, audit or compliance
• Deep understanding of technology and security control environments and risks, with strong controls framework and security architecture experience
• Strategic mindset on the business and customer impact of technology risk, with strong analytical and problem-solving skills for complex, ambiguous situations
• Ability to build stakeholder relationships and grow capability among non-specialist staff

Qualifications

• Relevant qualifications preferred (e.g. CISSP, CISM, CRISC, CISA or ISO 27001 Lead Implementer)

You’re not expected to have 100% of these skills. At ANZ a growth mindset is at the heart of our culture, so if you have most of these things in your toolbox, we’d love to hear from you.

So why join us?

From the moment you join ANZ, you'll be doing meaningful work that will shape a world where people and communities thrive.

But it's not just our customers who'll feel your impact. You'll feel it too. Because at ANZ, you'll have the resources, opportunities, and support you need to take the next big step in your career.

We're a diverse bunch at ANZ in different roles, different locations, doing different things. That's why we have a range of flexible working arrangements, so our people can 'make work, work for them'. We also provide a range of benefits including access to health and wellbeing services and discounts on selected products and services from ANZ and more.

At ANZ, you'll be part of an organisation where the different backgrounds, perspectives and life experiences of our people are celebrated. That's because we're committed to building a workplace that reflects the diversity of the communities we serve. We welcome applications from everyone and encourage you to talk to us about any adjustments you may require to our recruitment process or the role itself. If you're a candidate with a disability or access requirement, and have an enquiry about the support provided, please let us know on your application or visit ANZ Accessibility and Inclusion Programs for alternate contact methods.

To find out more about working at ANZ, visit https://www.anz.com.au/careers. You can apply for this role by visiting ANZ Careers and searching for reference number 127081 .

Job Posting End Date

13/11/2026, 11.59pm, (Melbourne Australia)