Manager - Cyber Defence Strategy

Overview

We are seeking a dynamic Manager for Cyber Defence Strategy and Operations to join our Information Systems team in Melbourne, Victoria. This role reports directly to the Chief Technology Officer (CTO) and plays a pivotal role in shaping and overseeing our enterprise cybersecurity strategy and operational resilience. You will lead and expand specialist security teams, enforce cybersecurity standards across our enterprise, and manage the security challenges associated with AI technologies in the modern threat landscape.

Key Responsibilities

• Develop and maintain a multi-year cybersecurity strategy along with a target-state security architecture for the company.
• Represent and communicate the organization's cyber risk posture to the CTO, Information Services Leadership, and the Board Risk Committee.
• Establish specialist sub-teams such as security architecture, vulnerability management, and cyber governance risk and compliance (GRC) to complement the Security Operations Centre (SOC), aiming to restore effective 24/7 coverage.
• Manage the enterprise-wide vulnerability management program, ensuring consistent remediation with ownership accountability.
• Lead incident response efforts for significant cybersecurity events by coordinating across IT, Legal, HR, and Communications departments.
• Define, implement, and govern the Zero Trust security program across Azure cloud services, identity management, and endpoint devices.
• Oversee and assure GHD’s AI security posture with special attention to agentic systems, non-human identities, and shadow AI concerns.
• Govern compliance and readiness activities for CMMC Level 2 and FedRAMP, supporting US Federal client engagements.

Required Experience and Expertise

• At least 12 years’ experience in cybersecurity with a proven record of building and leading specialized security sub-functions within large or global organizations.
• Broad expertise in security strategy, operational practices, threat intelligence, vulnerability management, and security architecture across cloud platforms (especially Azure), endpoints, networks, identity, applications, and data.
• Proficiency in Zero Trust architecture and Microsoft security technologies including Defender, Sentinel, Entra ID, and Purview.
• Practical knowledge and experience with cybersecurity regulatory frameworks such as CMMC Level 2, FedRAMP, ASD Essential Eight, ISO 27001, and NIST Cybersecurity Framework.
• Successful experience guiding organizations through regulatory certifications and communicating cyber risk effectively to senior executives and board-level stakeholders.
• Expertise in incident command and the ability to set enterprise-wide security standards collaboratively.
• Certifications required: CISSP, CISM, or equivalent. Highly desirable certifications include CMMC Registered Practitioner/Professional and Microsoft SC-100 or AZ-500.

Why This Role Is Rewarding

• Opportunity to provide enterprise cyber leadership directly to CTO and Board Risk Committee.
• A mandate to build and lead a specialist, high-performing cybersecurity team from strategy through execution.
• Leverage security as a strategic enabler to access US Federal government business through CMMC and FedRAMP readiness.
• Lead the definition of AI security posture at a critical juncture in emerging cyber threats.
• Work within a global framework reinforcing our Technology Mastery strategy for 2035.

Company and Cultural Commitment

GHD is a global professional services firm dedicated to engineering, architecture, and environmental consultancy. We operate with inclusion and diversity at our core, encouraging applications from all backgrounds including Indigenous peoples and diverse identities. Hybrid flexible work arrangements support the well-being and productivity of our worldwide workforce.

Additional Information

We are an equal opportunity employer invested in providing a recruitment process accessible to all candidates. Our team is diverse and inclusive, reflecting our commitment to social responsibility and innovation.