ASD 4, 5 & 6 Cyber Security Assessors & Information Security Analysts

The Opportunity

Information Security Branch is part of the Australian Signals Directorate's Security, Finance and Property Division. Alongside Security and Integrity Branch, it delivers shared security services to ASD and the Defence Intelligence Agencies. The Branch protects ASD's electronic information, systems and people through integrated security advice, assessment, monitoring, response, assurance, and capability services.

ASD 4, 5, & 6 Cyber Security Assessor

• Support, conduct or lead system security risk and control assessments, commensurate with classification.
• Review system architectures, data flows, configurations and security evidence against the PSPF, ISM and ASD policy.
• Identify threats, vulnerabilities, control gaps and business impacts, and determine residual risk.
• Recommend proportionate risk treatments and work with stakeholders to resolve security issues.
• Prepare clear assessment findings, security advice and system authorisation briefs.
• Monitor actions, maintain assessment records and escalate significant risks or evidence gaps.
• Contribute to peer review, staff development and continuous improvement of assessment practices.

ASD 4, 5, & 6 Information Security Analyst (Assurance)

• Support, conduct or lead continuous security monitoring and assurance activities, commensurate with classification.
• Collect, validate and correlate asset, vulnerability, configuration, incident, system change and remediation information.
• Identify, triage and assess vulnerabilities, misconfigurations, control exceptions and emerging risks.
• Evaluate exposure, business impact and control effectiveness to prioritise remediation and escalation.
• Work with system owners and technical teams to agree actions and verify evidence-based closure.
• Provide advice on remediation, residual risk, risk acceptance and reassessment requirements.
• Produce security posture, trend and executive assurance reporting to support risk and authorisation decisions.
• Contribute to quality assurance, staff development and improvement of assurance methods, data, tools and reporting.

ASD 4, 5, & 6 Information Security Analyst (Advice)

• Support, provide or lead IT security advice, commensurate with classification.
• Triage security requests and obtain the business and technical information needed to assess them.
• Interpret legislation, the PSPF, ISM and ASD policy, translating requirements into practical controls and recommendations.
• Assess security risks associated with systems, architectures, projects, changes and operational activities across the ICT lifecycle.
• Prepare defensible security advice, approval recommendations, conditions and decision records.
• Support threat and risk workshops, design reviews, and security assessments.
• Communicate risks and treatment options clearly to technical, business and senior stakeholders.
• Develop, maintain, and uplift organisational ICT security awareness, specialist training, guidance and self-service resources.
• Contribute to quality assurance, staff development, and continuous service improvement.

ASD 5 Information Security Analyst (Monitoring and Response)

The role is responsible for monitoring Security situational awareness and automation tools for security events and alerts, with a greater degree of autonomy than expected from an ASD 4 Analyst.

The ASD 5 Analysts perform the following tasks:

• Investigate information security incidents in line with broad direction set out by senior staff, while ensuring that incident response processes are being followed.
• Analyse and resolve identified security incidents in accordance with established procedures and recommend any required actions.
• Contribute to digital forensic investigations by processing and analysing evidence and artefacts in line with policy, standards and guidelines and support production of forensics findings and reports.
• Utilise a diverse set of capabilities, including various SIEM and investigation capabilities, to investigate cyber security and insider threat incidents. Be able to develop skills in new capabilities as required as part of investigations.
• Provide assistance with the development of a technical remediation plan and deliver findings to system owners and stakeholders.
• Communicate technical findings and recommendations through formal reporting, briefs, emails and verbal advice in accordance with the Australian Signals Directorate writing standards.
• Collaborate with organisations and stakeholders to provide remediation advice/plan to system owners and managers in order to improve system security posture.
• Build and sustain effective working relationships with team members and actively participate in teamwork and group activities.
• Facilitate appropriate direction, including technical direction, for their employees by clearly communicating goals and objectives.

ASD 6 Information Security Analyst (Monitoring and Response)

The ASD 6 Analysts are employed in either the Security Operations Centre (SOC) or Protective Monitoring teams. These teams are responsible for analysing information from multiple sources to protect ASDs people, resources and capability. The SOC is responsible for monitoring for external threats, and Protective Monitoring is responsible for monitoring risks associated with ASD and DIA employees.

The ASD 6 Analysts perform the following tasks:

• Monitor incoming alert queues for potential security incidents
• Perform initial investigation analysis and triage of alerts, documenting findings in the Incident Management platform
• Provide Subject Matter Expertise (SME) when performing investigation analysis and the development of new security use-cases
• Manage the implementation of security use-cases in SIEM and Automation platforms.
• Review security use-cases in development and provide an approval gateway at each step of the development lifecycle.
• Sustain effective working relationships with team members and actively participate in teamwork and group activities
• Facilitate appropriate direction, including technical direction, for their employees by clearly communicating goals and objectives.
• Communicate technical findings and recommendations through formal reporting, briefs, emails and verbal advice in accordance with the Australian Signals Directorate writing standards
• Utilise a diverse set of capabilities, including various SIEM and investigation capabilities, to investigate cyber security incidents. Be able to develop skills in new capabilities as required as part of investigations

Security Operations Centre (SOC) Team specific

• Escalation point for security Incidents
• Contribute to digital forensic investigations by processing and analysing evidence and artefacts in line with policy, standards and guidelines and support production of forensics findings and reports
• Collaborate with organisations and stakeholders to provide remediation advice/plan to system owners and managers in order to improve system security posture

Protective Monitoring Team specific

• Analyse and report on security-relevant data for Personnel Security investigations
• Maintain use-case playbooks, checklists and analyst Standard Operating Procedures (SOPs)
• Develop and maintain automated reports
• Support Personnel Security activities as required, including the case management process

Further information can be found at: I’m changing my career | Australian Signals Directorate (asd.gov.au)

ASD is seeking applicants to fill current and anticipated vacancies and to create a merit pool for future vacancies. In line with the Australian Public Service Commissioner’s Direction 2022, upon completion of the recruitment activity, the merit pool will be available to locations across Australia.

Our Ideal Candidate

We are looking for curious, analytical and service-oriented security practitioners. Candidates may bring experience in assessment, continuous assurance, advice, security operations, protective monitoring and are not expected to demonstrate specialist expertise across all streams. Appointment level will reflect the complexity of work performed, degree of independence, judgement and leadership demonstrated.

Technical and analytical capability appropriate to the classification, with experience assessing systems, controls, vulnerabilities or security evidence and converting findings into defensible risk positions.

Practical knowledge of cyber security principles and the ability to interpret and apply the PSPF, ISM, organisational policy and risk management practices to real-world ICT environments.

Clear written and verbal communication, sound judgement and a service-oriented approach, including the ability to build productive relationships and tailor advice for technical and non-technical audiences.

A collaborative and accountable approach to delivery, continuous learning and improvement; ASD 6 candidates should also demonstrate the ability to guide work, assure quality and build team capability.

Application Closing Date: Sunday 13th September 2026

For further information please review the job information pack, reference ASD/04958/26 on www.asd.gov.au/careers.

Pay: $85,993.00 – $119,654.00 per year

Work Location: In person