Role Purpose

At Yarra Trams, our mission is to deliver world-class transport services to our passengers. In this role, you will contribute to this goal by

• Performing Information Security Risk Management activities;
• Performing Information Security Compliance activities;
• Performing Information Security Remediation activities;
• Supporting Information Security Assurance, Governance and Operational activities;
• Leading and following safe work practices;

Responsibilities

• Prepare reports and communicate with stakeholder (including staff and external parties) the compliance against information security obligations of the Franchise Agreement.
• Define and regularly update the Yarra Trams Protective Data Security Plan (PDSP) and monitor the progress of the plan execution.
• Ensure alignment of the Yarra Trams Information Security Management System (ISMS) with the legal and regulatory environment.
• Ensure Yarra Trams compliance with the Information Security Risk management standards ISO 27005, OVIC Victorian Protective Data Security
• Standards (VPDSS), and Security of Critical Infrastructure (SoCI) obligations.
• Establish, implement, and maintain The YT Security Risk Profile Assessments (SRPA).
• Participate in regular OCMS Risk review meetings and ensure that all relevant OCMS Risk are accurate and up to date.
• Trigger Risk reviews and maintain Information Security Risk Register in the Corporate Risk Management System.

Skills & Experience

• Tertiary qualifications in Information Technology and/or significant proven experience, relevant to this discipline.
• 5-10 years’ Experience in OCMS Information Security Management and auditing.
• Proven ability to successfully develop, implement, enforce, audit, and continuously improve information security governance frameworks/systems work.
• Sound knowledge and understanding of relevant security frameworks, standards, and policies, including the Victorian Protective Data Security Framework (VPDSF), Victorian Protective Data Security Standards (VPDSS) and the Australian Signals Directorate (ASD) guidance tools such as the Information Security Manual (ISM).
• Understanding of various Risk Management frameworks such as NIST 800, ISO 27005 and ISO 31000.
• Sound understanding of information security and its relationship to organisational risk and enterprise architecture.
• Stakeholder engagement skills - Ability to engage with employees at all levels of the business and relevant third parties to identify information security requirements, implement and audit systems of work and recommend mitigations to address information security incidents and hazards.