Help build the security foundations of Australia's new scams dispute resolution framework.At AFCA, we're preparing to deliver a world-first external dispute resolution scheme under the Scams Prevention Framework (SPF), providing Australians with an independent pathway to resolve scam-related complaints across banking, telecommunications and digital platforms.We're looking for an experienced Information Security Manager to help design and implement the information security, governance and information management controls that will support this significant new function. This role sits at the intersection of cyber security, information governance, privacy, risk and business transformation, ensuring highly sensitive information is managed securely and responsibly from day one.The opportunityReporting to the Chief Information Security Officer (CISO), you'll play a key role in assessing AFCA's capability to securely receive, handle, store, classify and share sensitive scams-related information.Working across Technology, Legal, Risk, Privacy, Data Governance and business stakeholders, you'll identify risks and capability gaps, develop practical uplift recommendations and help implement secure operating practices that support both the Scams EDR Program and AFCA's broader information management maturity.This is a rare opportunity to influence how a new national scheme manages sensitive information while helping shape security and governance practices across a rapidly evolving environment.This role is a 12-month max-term contract initiallyWhat you'll be doingAssess current information security and information management capabilities across the Scams EDR Program.Identify gaps in systems, processes, controls and information handling practices.Develop and deliver security uplift recommendations and implementation roadmaps.Support the design of secure information handling, classification and information lifecycle management practices.Partner with Privacy, Data Governance, Records Management, Technology Governance and Risk teams to strengthen security controls.Provide practical advice on document classification, access controls, secure information sharing and information governance.Support assurance activities, control reviews, audits and evidence gathering.Create security assessments, guidance materials, procedures and executive-level reports.Drive awareness and capability uplift across teams handling sensitive scams-related information.
