Control Lead PAM - job description

Are you an identity security specialist ready to own a critical control end to end? Have a deep understanding of the cyber threats relating to credential theft and privilege escalation? Have experience developing and implementing privileged access management policies and delivering security outcomes in large, complex environments? This role might be your next step...

Control Lead (Senior Manager) Privileged Access Management

You are a cybersecurity risk and control leader with deep identity and privileged access expertise and a track record of leading high-performing teams. We are one of the best and most advanced Cyber Security teams in Australia. Together we can build the Cyber Controls Chapter Area and contribute to protecting the Group, its customers and community.

Your business The Technology division delivers the Group's information technology and banking operation functions to ensure the highest levels of customer service through world-class process excellence and technology innovation. Cyber Security protects the bank and our customers from theft, loss and risk events through effective and proactive management of cyber security, privacy and operational risk.

We support our people with the flexibility to balance where work is done, with at least half your time each month connecting in the office. We also have many other flexible working options available including changing start and finish times, part-time arrangements and job share to name a few. Talk to us about how these arrangements might work for you.

Your new team The Cyber Controls Chapter Area plays a crucial GRC function within the Group Security division. It is responsible for defining and implementing effective cyber control capabilities and driving continuous improvement of the Group's cyber risk profile.

The Control Lead Privileged Access Management leads a team of control specialists accountable for the Group's PAM control. The team defines PAM policy, standards and guidelines, works with Identity & Access Technology and platform teams to implement privileged access capabilities, and governs control compliance across the Group.

Your impact and contribution Working with the Cyber Controls Chapter Area Lead and collaborating with peer Control Leads, you will:

• Lead, coach and develop a team of Control Managers and Analysts, setting priorities and directing capacity toward the highest risk areas.
• Own the PAM control strategy and roadmap, working with Identity & Access Technology, Security Engineering, Enterprise Architecture and Technology Platform Owners.
• Establish and maintain PAM policy, standards, guidelines and design/operating-effectiveness criteria in line with the evolving threat landscape and technology strategy.
• Govern the Group's compliance with PAM control requirements in line with the Group Operational Risk Management Framework (ORMF) and external obligations such as APRA CPS 234, ISO 27001 and Essential Eight.

You will also:

• Drive Go to Green: lead the PAM control's path to target state, prioritise control weaknesses and hold technology teams to remediation.
• Oversee control operation: make sure privileged accounts are discovered, inventoried, vaulted and monitored in line with the IAM Standard and PAM Guidelines.
• Measure and report effectiveness: keep coverage, compliance and control health metrics up to date, and support monthly governance reporting, Control Self-Assessments and independent control testing.
• Close issues: lead closure of RiS issues by coordinating evidence, demonstrating control uplift and getting endorsement from Line 1 and Line 2 Risk and assurance stakeholders.
• Govern exceptions: provide front-door control advice, assess proposed deviations and make sure exceptions go through the required risk assessment and endorsement.
• Shape the future of identity: extend PAM requirements to non-human, machine and agentic AI identities, and drive automation of control evidence and compliance checks.

We are interested in hearing from people who:

• Embody the leadership principle of 'Curious and Humble' by being willing to speak up and challenge the status quo, and continually expanding their skills and knowledge.
• Have led and developed teams of control, risk or security professionals, and can balance operational upkeep with strategic delivery.
• Have deep experience in Identity and Access Management, Cyber Security Controls  within a large, complex organisation.
• Have a strong risk mindset and can translate technical concepts into practical control requirements, standards and risk outcomes.
• Thrive in ambiguity and bring structure and clarity to emerging problems where there isn't an established playbook.
• Can engage and influence senior stakeholders across technology, architecture, engineering and risk to build rapport, obtain buy-in and achieve target outcomes.

Technical skills that will benefit you in the role:

• Applied knowledge of APRA CPS 234, ASD ISM, Essential Eight (restrict administrative privileges), NIST CSF and ISO 27001, and how to turn them into control standards and design/operating-effectiveness criteria.
• Strong understanding of IAM concepts including authentication, authorisation, MFA, identity lifecycle and privileged access management.
• Hands-on familiarity with enterprise PAM solutions such as CyberArk, Hashicorp including vaulting, session management, credential rotation and just-in-time access.
• Understanding of privileged access risks across on-premises, cloud and SaaS environments, including Active Directory, Entra ID and cloud IAM.
• Awareness of non-human identity and agentic AI security risks, such as service accounts, secrets management and workload identities.
• Experience in control assurance under an operational risk framework, including control testing, Control Self-Assessments, issue and exception management.
• Security certifications such as CISSP, CISM or CRISC. Vendor PAM certifications are a plus.