Security Specialist

Job Description

The Security Specialist will lead and support key cyber security governance, risk and compliance (GRC) activities across Kinde. This is a permanent, full-time role based in Australia, remote or from agreed locations.

You’ll be responsible for developing and maintaining security policies and controls, managing cyber security risks, coordinating security audits and compliance assessments, and supporting Kinde’s ongoing SOC 2 and ISO 27001 certification and assurance activities.

Working across engineering, technology, operations, and business teams, you’ll translate security, regulatory, and compliance requirements into practical controls and processes that protect Kinde’s systems, platform, customer information, and business operations.

Key Responsibilities

• Develop, implement, maintain and continuously improve cyber security policies, procedures, standards and guidelines in line with regulatory requirements, industry standards and recognised security practices.
• Lead cyber security risk management activities, including identifying, assessing and prioritising risks, maintaining risk assessments, developing risk treatment and mitigation plans, and reporting security risks to relevant stakeholders.
• Lead the planning, preparation and execution of security certification and assurance activities, including SOC 2 and ISO 27001, coordinating audits, evidence collection, documentation, remediation and ongoing compliance.
• Conduct security audits, compliance assessments and control reviews to identify security gaps, evaluate control effectiveness and recommend improvements.
• Identify and assess security vulnerabilities and control weaknesses across systems, applications and infrastructure, evaluate their associated business risk and coordinate risk-based remediation with engineering and technology teams.
• Build and maintain Kinde’s cyber security governance framework, including security policies, procedures, controls, risk management processes and supporting documentation.
• Develop and maintain appropriate information and system classification requirements to support the prioritisation and implementation of security controls and risk mitigation activities.

Skill & Experience

As a Security Specialist at Kinde, you’ll work across governance, risk, compliance, and assurance. As a growing company, there’s lots to do and everyone pitches in. We know you’ll have a range of skills and experience that you can use to help us in our mission, but below are just a few of the main ones that we’re looking for:

• Demonstrated professional experience in Cyber Security Governance, Risk and Compliance (GRC), including security risk assessments, risk treatment and mitigation, compliance assessments and security governance.

• Experience developing, implementing and maintaining cyber security policies, procedures, standards and controls aligned with regulatory requirements and recognised industry practices.

• Demonstrated experience supporting or leading security audits, assurance and certification activities, particularly ISO/IEC 27001 and SOC 2.

• Strong knowledge of cyber security and risk management frameworks, including ISO/IEC 27001 and NIST Cybersecurity Framework, with the ability to translate framework requirements into practical organisational controls.

• Experience assessing security control effectiveness, identifying security and compliance gaps and coordinating appropriate remediation activities.

• Knowledge and practical experience in privacy, data protection and regulatory compliance, with the ability to translate legal and regulatory requirements into practical information security controls, policies and processes.

• Experience developing security governance documentation and providing practical cyber security guidance and awareness to technical and non-technical stakeholders.

• Strong stakeholder management and communication skills, with the ability to work collaboratively across engineering, technology, operations and business teams.

• Relevant tertiary qualifications in Cyber Security, Information Technology, Information Security, Risk Management, Data Protection, or a related discipline.