Cyber Security Governance Analyst

#

# Primary Details
Time Type: Full time

Worker Type: Employee

The purpose of this role is to support transformational change in Cyber and information security risk management within the core business, 3rd party suppliers, programs, and projects at QBE. This role is part of a Group Cyber Security team responsible for safeguarding the company from sophisticated cyber threats, requiring deep technical knowledge and a collaborative approach to deliver strategic business outcomes.

Shadow IT Identification & Risk Assessment

- Support the identification and analysis of Shadow IT, Business-Managed IT solutions and 3rd Party-Mandated solutions across QBE.
- Conduct risk assessments of identified applications, platforms and services.
- Evaluate technology solutions against control requirements and governance frameworks.
- Review supporting documentation, authoritative sources and operational processes to assess risk exposure.
- Identify, document and communicate identified technology risks, control gaps and remediation recommendations.
- Support the maintenance of Shadow IT inventories and associated risk registers.
- Track remediation activities throughout the lifecycle to ensure status is updated along the way and identified applications, platforms and services are moved to appropriate state.

Governance, Compliance & Oversight

- Support the development, implementation and maintenance of QBE's Shadow IT governance framework, processes and standards.
- Monitor compliance with governance requirements and minimum control standards.
- Coordinate periodic reviews and re-assessments of identified solutions to ensure ongoing compliance.
- Assist in providing information needed to document policy exceptions, risk acceptances and governance approvals.
- Support governance forums by preparing reporting, metrics and risk summaries.
- Track and report on remediation activities and governance outcomes.
- Contribute to the development and maintenance of governance documentation, standards and operating procedures.

Stakeholder Engagement & Advisory

- Partner with business and IT stakeholders to understand technology usage and support risk-informed decision making.
- Provide guidance on Business-Managed IT and 3rd Party-Mandated governance requirements, risk management expectations and security controls.
- Support business teams through onboarding, review and governance approval processes.
- Collaborate with Technology, Cyber Security, Risk, Privacy, Compliance and Procurement teams to address identified risks and control gaps.
- Assist in raising awareness of Shadow IT risks and governance requirements across the organisation.
- Support workshops, assessments and stakeholder engagement activities relating to Shadow IT governance.

Reporting & Data Analysis

- Maintain governance dashboards, inventories and reporting related to Shadow IT, Business-Managed IT and 3rd Party-Mandated technology risks.
- Analyse trends, emerging risks and recurring governance issues to identify improvement opportunities.
- Prepare reports, presentations and risk summaries for governance committees and leadership stakeholders.
- Monitor key risk indicators, compliance metrics and management actions.
- Support internal audit, regulatory and assurance activities relating to Shadow IT governance processes.

Continuous Improvement & Capability Development

- Contribute to the ongoing enhancement of QBE's Shadow IT governance capability, processes and tooling.
- Identify opportunities to improve governance efficiency, automation and user experience.
- Assist with the development of guidance materials, training content and awareness initiatives.
- Support process reviews to ensure governance frameworks remain effective, scalable and aligned to business needs.
- Monitor industry trends, regulatory developments and emerging risks associated with business-managed technology solutions.
- Contribute to initiatives that strengthen cyber risk management, technology governance and operational resilience.

About You

To be successful in this role, you will demonstrate:

- Experience in Cyber Security, Information Security, Technology Risk, IT Governance, Operational Risk or a related discipline.
- Experience supporting risk assessments, governance activities or compliance programs.
- Understanding of cybersecurity risk management principles and governance practices.
- Knowledge of information security frameworks and standards such as ISO 27001, NIST CSF, COBIT or related frameworks.
- Ability to assess risk and translate technical concepts into clear business outcomes.
- Strong analytical and problem-solving skills with excellent attention to detail.
- Ability to manage multiple activities and priorities in a structured and organized manner.
- Strong written and verbal communication skills.
- Effective stakeholder engagement skills and the ability to work collaboratively across business and technology teams.
- Experience preparing reports, metrics, governance documentation and risk summaries.
- A proactive mindset with a strong focus on continuous improvement.
- A collaborative and customer-focused approach to delivering outcomes.

Preferred Qualifications

- Degree in Cyber Security, Information Technology, Risk Management, Business, Governance or a related discipline.
- Professional certifications such as Security+, CISA, CRISC, CGRC, COBIT Foundation, ISO 27001 Foundation or equivalent.
- Experience working within regulated industries such as insurance, financial services or banking.
- Experience supporting technology governance, Shadow IT, SaaS governance, operational risk or compliance programs.
- Experience working with governance, risk and compliance (GRC) platforms, workflow tools or technology inventory solutions.
- Familiarity with cloud technologies, SaaS platforms and modern business application environments.

Key Focus Areas of the Role

- Shadow IT discovery and assessment
- Business-Managed IT and 3rd Party-Mandated governance
- Compliance monitoring and reporting
- Risk identification and remediation tracking
- Stakeholder engagement and advisory
- Governance framework development and continuous improvement

Skills:
Analytical Thinking, Conflict Management, Critical Thinking, Customer Service, Cybersecurity, Cyber Security Governance, Cyber Threat Intelligence, Financial Systems, Intentional collaboration, Managing performance, Problem Solving, Risk Management, Security Monitoring, Threat Mitigation, Vulnerability Management

How to Apply:

To submit your application, click "Apply" and follow the step by step process.

Equal Employment Opportunity:

QBE is an equal opportunity employer and is required to comply with equal employment opportunity legislation in each jurisdiction it operates.