ICT Risk and Assurance Lead

About the role

Transpower owns and operates New Zealand's National Grid and manages the real-time operation of the electricity system. Its Security Services team, within Information Services and Technology, protects the technology, identities and services behind critical operations. With the incumbent retiring, Transpower is looking for an experienced ICT risk and assurance practitioner to act as ICT Risk & Assurance Manager, managing and delivering risk assessments, assurance activities and reporting, and providing technical leadership across ICT risk, assurance, resilience and governance. The role reports to the Head of Security Services and works closely with the Head of Risk and Assurance.

Key responsibilities

• Provide leadership and subject matter expertise on ICT risk, governance and assurance, and build risk and assurance capability across the organisation
• Manage the assurance schedule and run regular reviews of risk control effectiveness, tracking findings so agreed actions are completed on time and to quality
• Develop and maintain bowtie-based risk models using a semi-quantified risk analysis approach
• Prepare executive reporting on risk exposure, control effectiveness, compliance and resilience
• Develop and maintain ICT risk management policies and standards, advise management and delivery teams on compliance, and prepare for cybersecurity regulation by engaging with regulators and government agencies
• Work with security specialists, technology and delivery teams, Enterprise Risk, Legal and Privacy, and business leaders, and engage with auditors, assessors, regulators and industry partners

Required profile

• At least five years' experience in ICT security, risk, assurance, audit or governance, including developing and operating ICT risk and assurance frameworks
• Sound understanding of ICT security environments and the implications of security risks for critical services
• Experience in regulatory compliance, assurance reviews and security control assessments
• Able to support delivery teams at an operational level and senior leaders as a trusted adviser, with clear reporting and stakeholder engagement
• Relevant tertiary qualification such as computer science, cyber security, information security, engineering, risk management or similar
• Ideally: experience in a large corporate or government organisation, in critical infrastructure or utilities, and familiarity with NIST, ISO 27001, CIS Controls or IEC 62443
• Existing eligibility to work in New Zealand is essential

What we offer

• Office or on-site work for a minimum of three days per week, with adaptable daily start and finish times
• Employee health and wellness benefits

Wellington is the preferred location; Hamilton may be considered depending on experience and influencing skills. Applications close on 16 November, reviewed as they arrive, with a handover planned for January.