Cyber Security Manager

About Compass Education

Join Compass Education and contribute to redefining the educational experience for students, staff, families, and administrators. We develop intuitive technology solutions that empower educational institutions to focus on learning and growth. Our platform supports over 5,000 schools across three countries, driven by a diverse team of over 300 members.

Position Overview

We are seeking a Cyber Security Manager to become a key member of our Technology team based in Melbourne. Reporting directly to the Head of Technology, you will develop and lead the organization's security strategy, oversee risk management, and enhance security standards across platforms, infrastructure, and applications. This role also involves mentoring a growing security team.

Key Responsibilities

• Collaborate with senior leadership to establish and maintain the security roadmap and standards.
• Create and update a formal risk register detailing vulnerabilities, remediation efforts, and residual risks.
• Advise leadership on security threats, incidents, and areas requiring investment.
• Conduct penetration testing on web applications, APIs, infrastructure, and cloud environments; coordinate third-party penetration tests.
• Identify and close security gaps including those related to access control, database security (MongoDB, Redis, SQL), secrets management, and cloud identity and access management (IAM).
• Enhance Google Cloud Platform (GCP) security configurations including VPC setup, IAM policies, audit logging, and Cloud Security Command Center.
• Collaborate with DevOps to strengthen infrastructure and review infrastructure-as-code such as Terraform and CI/CD workflows.
• Manage application security efforts, enforce secure development lifecycle practices, and participate in code reviews.
• Lead incident detection, response, and security investigations ensuring compliance with privacy laws across Australia and the UK/EU.
• Govern data access policies outlining access rights, conditions, and auditing.
• Provide leadership and mentorship to junior security team members, managing workload and professional growth.

Candidate Profile

• 5+ years of direct experience in cyber security, focusing on both application and infrastructure domains.
• Advanced skills in penetration testing across web, API, network, and cloud systems including third-party engagement management.
• Strong knowledge of cloud security practices, specifically in GCP or AWS including IAM, network security, audit logging, and secrets management.
• Experience with vulnerability assessment and remediation in live production environments.
• Competence in security risk management encompassing risk register maintenance, remediation prioritization, and risk communication to non-technical stakeholders.
• Understanding of security controls within relational and NoSQL databases, including encryption and audit logs.
• Familiarity with Australian SaaS compliance rules and privacy regulations.
• Excellent ability to communicate technical risks and translate security needs into engineer-friendly guidance.
• Proven experience leading or coaching junior security professionals.

Additional preferred qualifications:

• Certifications such as OSCP, CISSP, or CISM.
• Knowledge of GDPR and UK/EU data protection standards.
• Background in EdTech, SaaS, or fast-paced scale-up organizations.

Benefits & Culture

• Flexible hybrid work arrangement with office hub in Melbourne.
• Dedicated professional development budget and opportunities.
• Continuous employee support through a 24/7 Employee Assistance Program including multiple support channels.
• Parental leave for both primary and secondary caregivers.
• Team engagement activities, social events, and office amenities to foster connectivity.
• Employee referral incentives.
• Inclusive and supportive workplace culture valuing diversity and employee voice.

Pre-employment Requirements

• Valid Employee Working With Children Check.
• Clear National Police Check.
• Proof of unrestricted work rights in Australia such as citizenship, passport, or birth certificate.