Join a customer-obsessed technology business at the heart of Australia’s largest retailer
Greenfield Opportunity to Innovate Beyond "Checkbox" Security
Norwest/Surry Hills (Sydney) based with a hybrid working model
We are Woolworths Group
We are Woolworths Group. 200,000+ bright minds, passionate hearts and unique perspectives connected by a shared Purpose – ‘to create better experiences together for a better tomorrow.’ It’s that Purpose that fuels our ambition to explore new ideas, make brave commitments and innovate better ways to meet the food and everyday needs of more than 24 million customers every week.
If you’re excited to turn today’s blue sky thinking into a better tomorrow for future generations, you’ll find yourself supported and enriched in a dynamic, inclusive and empowering workplace that reflects the diverse communities we serve. With a culture of genuine care, a flexible approach to work and opportunities across the group to grow your career and make a meaningful impact, the possibilities for what we can achieve together are endless.
The Position
This strategic role sits directly under the CISO and is designed to lead the group’s Cyber governance, risk, and compliance engine. It bridges the gap between technical controls and executive-level risk appetite, shifting our risk posture from static, "checkbox" compliance to a dynamic, threat-informed model.
What you’ll do
This leader holds group-wide accountability for translating macro corporate policies into practical, threat-aligned cyber standards, executing rigorous control assessments, and establishing a formal (Line 1) Cyber Risk capability.
Risk Taxonomy & Controls Universe Evolution: This role is tasked with interfacing with Group Risk in defining and documenting our supporting risk taxonomy, risk ownership model, and metrics. This includes aligning our risk appetite, tolerances, Key Risk Indicators (KRIs), and escalation thresholds directly with the Group's Level 1 risk standards.
Controls Framework Baseline: This role is mandated to standardise the internal cyber controls assessment framework. This baseline provides Technology domains and business units with a clear, unified benchmark against which their systems and environments will be measured.
Continuous Control Validation: Moving from static auditing to continuous, data-driven Tests of Effectiveness (ToE) and control self-assessments.
Policy Modernisation: The role owns the Cyber Policy Framework and is responsible for its evolution, along with translating these high-level corporate policies into practical, threat-aligned technical standards and baselines.
Audit & Regulatory Defensibility: Serving as the Cyber Security single coordinated front door for Group Internal Audit and external regulators (addressing SOCI Act, PCI-DSS compliance and Privacy Act reforms).
Operational Line 1 Execution: This role establishes and operationalises the risk taxonomy and control’s universe at the operational level. This ensures that control testing and risk identification are performed with deep technical fluency and aligned with day-to-day threat context.
What you’ll bring
Relevant 15 years work experience including 8+ years in IT leadership roles and 5+ years of experience in Cyber Security Risk, Compliance, or Assurance.
Executive leadership experience managing risk and compliance across large, complex, and highly regulated environments (such as retail or critical infrastructure).
Proven track record in transitioning from qualitative, compliance-centric models to quantified, threat-led risk postures.
Risk Translation & Quantification: Ability to translate abstract cyber risks into quantifiable financial impacts and measurable risk reduction outcomes to drive consistent investment decisions.
Enterprise Risk Orchestration: Skill in balancing domain-specific technical fluency with enterprise-wide risk consistency, working effectively as the Line 1 partner to the Line 2 oversight function.
Regulatory Acumen: Deep expertise in navigating complex regulatory environments (e.g., SOCI, Privacy) and bridging the gap between technical IT controls and legislative obligations.
Executive Communication: Designing insight-driven reporting and translating complex threat data into strategic risk narratives for the Technology ExCo and the Board
What you’ll Experience
Team Discounts - Team discounts across our range of Woolworths Group brands you know and love and a robust rewards program that celebrates and incentivises purpose-driven work.
12 weeks paid parental leave for primary caregivers. Woolworths Group will also continue to pay superannuation for up to 12 months (subject to relevant caps) while the Team Member is on parental leave (paid or unpaid).
4 weeks paid leave for secondary caregivers
Wellness - Access to Sonder. Sonder provides free confidential 24/7 personalised financial, medical safety, psychological or physical support for team members and their families.
Everyone belongs at Woolworths Group
As one of the largest employers in Australia and New Zealand, we aim to create a truly inclusive workplace where everyone feels that they belong, can be their best selves, and reach their full potential.
Diversity, equity, inclusion, and belonging are key to realising our purpose of better together for a better tomorrow. We recognise the value our team’s diversity brings to our business, customers, and communities and that teams with diverse experiences and backgrounds enrich our group and are better able to innovate and solve problems.
