IT Security Analyst - Assurance

Your Role 

Our IT Security team is looking for an IT Security Analyst to deliver technical security risk analysis and assurance activities across MinterEllison's technology environment. The role spans two core functions: (1) technical security risk analysis – including threat and risk assessments, security architecture reviews, and vulnerability analysis; and (2) assurance coordination – including client questionnaires, supply chain security, penetration testing oversight, user awareness, and compliance with security standards. 

This is an internal role reporting into the IT Security GRC Manager. You will work closely with the broader IT Security team, IT Architecture, IT Operations, IT Procurement, and managed services providers. 

Key Responsibilities 

• Conduct threat and risk assessments for new and existing systems, applications, and AI solutions, producing structured risk reports with prioritised remediation recommendations 

• Perform security architecture reviews on proposed and existing solutions against MinterEllison standards and applicable frameworks 

• Provide security risk input into IT projects at key stages, ensuring security is embedded by design 

• Analyse vulnerability scan results, triage findings by risk severity, and track remediation to closure 

• Coordinate penetration testing activities including scoping, third-party coordination, and remediation tracking 

• Respond to client questionnaires, audits, security program enquiries, and RFPs 

• Perform supply chain security reviews and maintain the risk register 

• Contribute to the IT Security awareness program and coordinate with broader training teams 

• Assist with maintaining ISO27001 and other compliance certification programs 

• Maintain MinterEllison's Security Trust Centre with regular updates 

• Run quarterly audits on privileged access, user access, mobile device compliance, and asset inventory 

• Assist with security incident response during and after business hours 

Knowledge, Skills and Experience 

• At least 2 years' experience in information security or IT risk, with hands-on exposure to technical security assessments 

• Demonstrated ability to conduct structured threat and risk assessments using recognised methodologies (e.g. STRIDE, OCTAVE, NIST RMF) 

• Practical exposure reviewing security architectures including cloud security (Azure/M365) and hybrid infrastructure 

• Familiarity with vulnerability management tooling (e.g. Qualys, Tenable, CrowdStrike) 

• Excellent knowledge of security frameworks such as ISO27001, SSAE16, APRA CPS234, ASD Essential 8, and NIST v2.0 

• Expert coordination skills with ability to maintain programs on schedule 

• Demonstrated experience writing high quality executive reports/briefings 

• Experience running internal IT audits and supplier assessments 

• Agile mindset with ability to manage tasks independently 

• Relevant certifications highly desirable (CISSP, CISM, CISA, CompTIA Security+, or cloud security certifications) 

Personal Attributes 

• High integrity and professionalism with excellent communication skills across all levels 

• Self-starter with strong analytical and problem-solving abilities 

• Excellent organisational and time management skills with attention to detail 

• Strategic focus ensuring daily activities add commercial value to the business