Nov 2020 – Jan 2021 · 2 mos · Sydney, New South Wales, Australia · Hybrid

• ➤Third Party Cyber Security Risk Management based on the Australian Prudential Regulation Authority (APRA) CPS 234 – Information Security.
• ➤Performed analysis of the cyber and resilience risks associated with potential and existing third party suppliers and related parties.
• ➤Responsible for performing due diligence on new suppliers enabling the business to obtain secure third-party services.
• ➤Managed the classification and tiering of third party supplier as well as administering third party cyber assessment software.
• ➤Maintained a current inventory of third party providers detailing their respective cyber risk.
• ➤Contributed to the continuous uplift of supplier cyber management capability.
• ➤Tracked key cyber security third party assessment metrics and generating reports to monitor the effectiveness of the third party program.
• ➤Collaborated with Allianz's Procurement, Legal, and Risk & Compliance Community on risks associated with third and related parties
• ➤Executed reviews of contract security schedules.
• ➤Assisted with maturing the third party cyber policies, standards and procedures owned by the team and helping to embed these across the organisation.
• ➤Performed Third Party Security Assessments using the clients’ provided questionnaire, Alyne and BitSight GRC tools.

Jul 2017 – Nov 2020 · 3 yrs 4 mos · North Sydney, New South Wales, Australia

• ➤Provided security advice to technology/business owners to ensure critical nbn environments and assets are protected with the right level of security controls.
• ➤Orchestrated the security requirements for major business transformation projects.
• ➤Coordinated effectively with different security teams (Security Architecture, Privacy, CSOC, and Physical Security) through engagement in various business projects.
• ➤Understand the business and information risk context and propose architectures and countermeasures to mitigate risk.
• ➤Worked closely with business managers, project teams, legal, procurement, solution architects and system engineers to identify, design and implement security controls which provide value driven risk reduction and alignment to compliance requirements.

Jan 2016 – Jun 2017 · 1 yr 5 mos · North Sydney, New South Wales, Australia

• ➤Owned a portfolio of NBN business units and be responsible for providing security advisory and assurance services, acting as their trusted advisor.
• ➤Identified and profiled emerging or imminent cyber threats that are likely to impact NBN business.
• ➤Identification, analysis and management of potential security breaches or incidents.
• ➤Maintained awareness of current cyber security standards and ensure all activities comply with these standards.
• ➤Evaluated potential vendors and third-party solutions for security scope. Managed the vendor life cycle, vendor risk identification and rating.
• ➤Provided security risk recommendations to the procurement and legal team to ensure outsourced and/or offshored services are appropriately assessed

May 2015 – Jan 2016 · 8 mos · North Sydney, New South Wales, Australia

• ➤Communicate the NBN Co security policies & corporate risk appetite & security architecture and standards (ISO/IEC 27001/27002, ISO/IEC 31000, ISO/IEC 27799:2008, IRAM, PSPF, Privacy Act, eTOM, TOGAF, SABSA, TNM) to the solution design and delivery teams in the Application domains.
• ➤Coordinate meetings, extract requirements, knowledge and documentation to then review designs against key domains of the target security architecture and NBN policies.
• ➤Provide consultancy advice regarding security and infrastructure.
• ➤Work with delivery teams & Solution Architects to ensure the security requirements for proposed solutions in the application domain are defined & satisfied.
• ➤Management of security exemptions throughout NBN space.
• ➤Communicate awareness of technical security architecture & standards within the application domain.
• ➤Ensure that all new project solutions receive a Threat Risk Assessment (TRA) review and development and refinement

Jan 2011 – Apr 2015 · 4 yrs 3 mos · Sydney, New South Wales, Australia · On-site

• ➤Responsible for designing, implementing and maintaining the Telstra Information Security Management System (ISMS) and for stewardship of ISMSs in Telstra. The role ensures the continuing suitability, adequacy and effectiveness of Telstra’s ISMS policy objectives, enforcing Telstra security policy and standards, consulting with other business units to ensure compliance with ISMS and Telstra information security requirements and coordinating a cluster-wide program of ISMS assessment and certification.
• ➤Operated and managed ISO/IEC 27001 and ISO/IEC 27002 accredited ISMS’s to regularly monitor and review Telstra information security processes to support ISMS objectives in the delivery of continual improvement of security management across the relevant Telstra business units, to maintain continued accreditation status and/or meet compliance needs.
• ➤Provided management relevant reporting from internal audit programs, review of implemented security controls, current risk management activities, corrective and preventive actions database record management and any other source of information in the delivery of information security compliance management programs.
• ➤Training, mentoring and development of ISMS and Information Security E-learning trainings across the Telstra Cloud Services and Telstra Network Division.

Jan 2008 – Dec 2010 · 2 yrs 11 mos · Sydney, New South Wales, Australia · On-site

• ➤Coordination of the Telstra ISMS assessment and certification program.
• ➤Conducted effective ISMS in accordance with stated business objectives.
• ➤Enforced ISMS policies, plans and methodologies throughout all support groups engaged in product delivery.
• ➤Engaged with all relevant business areas, service delivery and common services teams, including third-party service providers to ensure effective ISMS.

Jan 2005 – Dec 2007 · 2 yrs 11 mos · Sydney, New South Wales, Australia · On-site

• ➤Audit various platforms, including Linux, Solaris, and Windows.
• ➤Chaired the Security patch management forum which recommends and tracks security patches across all platforms
• ➤Monitored and investigated security breaches across customer LAN, WAN and gateways.
• ➤Vulnerability assessment for Internal and External customers.

Jan 2000 – Dec 2004 · 4 yrs 11 mos · Sydney, New South Wales, Australia · On-site

Jan 1998 – Dec 1999 · 1 yr 11 mos · Sydney, New South Wales, Australia · On-site