Technology Risk Analyst

Avant is Australia’s leading medical defence organisation with a proud heritage of protecting Australian medical professionals for over 130 years.
Avant now represents 90,000 health practitioners and medical students across every state and territory, delivering market leading products and services to meet their professional, personal and practice needs. Building on this heritage, our vision is to be the most trusted professional partner in supporting doctors throughout their lives and careers.
**About the role**:
At Avant, we’re committed to building a secure, resilient, and future-ready insurance business. As a trusted name in the industry, we understand the importance of protecting our data, systems, and members.
As Technology Risk Analyst, you will play a key role in shaping and maintaining our information security and technology risk framework, supporting compliance with regulatory requirements, mitigate risks and align security practices with industry standards.
This role is key to embedding a risk-aware culture and enabling a secure operational environment across the business.
**Key responsibilities**:
Governance & Strategy
- Support the development and operationalisation of the information security governance framework.
- Ensure alignment with regulatory standards including APRA CPS 234, NIST, Essential 8, and ISO 27001.
- Assist in aligning security strategies with broader business goals.
- Develop and maintain security metrics, KPIs, and reporting to senior management and board committees.
- Operationalise security and technology control requirements within Group Solutions, ensuring they are documented, monitored, and maintained.
- Support control testing and assurance activities to validate operating effectiveness.
- Coordinate reporting of control gaps, remediation plans, and progress to stakeholders.

Risk Management
- Conduct information security risk assessments and recommend mitigation strategies.
- Monitor emerging threats, vulnerabilities, and technological shifts.
- Collaborate with business units and the three lines of defence to manage risk effectively.

Compliance & Audit
- Support compliance with APRA CPS 234, CPS 230, Australian Privacy Principles, and other relevant regulations.
- Lead and manage information security audits, including tracking findings through to remediation.
- Maintain clear documentation to demonstrate adherence to compliance standards.

Incident Management
- Support the incident reporting and management process.
- Participate in post-incident reviews and help implement improvements.

**Skills and experience required**:

- Bachelor’s degree in information security, Cybersecurity, IT, Risk Management, or a related field.
- Preferred certifications: CISM, CISA, CRISC, ISO 27001 Lead Implementer/Lead Auditor.
- 1-2 years’ experience in cybersecurity governance, risk, control or compliance roles, preferably in insurance or financial services industry.
- Proven track record in managing audits, regulatory reviews, and risk assessments.
- Deep knowledge of APRA regulations and cybersecurity frameworks.
- Strong understanding of IT infrastructure, cloud environments, and cybersecurity tools.
- Effective communicator—able to explain complex topics to technical and non-technical stakeholders.
- Analytical and problem-solving mindset with attention to detail.
- Ability to influence cross-functional teams and drive security-focused change.

We have a diverse and connected work environment where your contribution and ideas will be valued and respected and make a real difference to the lives of others. We offer a range of benefits and opportunities to enable you learn and grow in your career.
For further information, please contact Sue Allen, Talent Acquisition Business Partner on 0429 404 856.