Building Australia’s Next Cyber Talent
21/08/2026 18:13
Australia’s future cyber security capability depends on the talent we develop today. That’s why at AMP, we’re proud to sponsor the Australian Schools Cyber Challenge, helping students explore pathways into one of Australia’s fastest-growing industries.
Tune in to hear from some of our cyber graduates and specialists as they share their advice for students considering a career in cyber.
Tune in to hear from some of our cyber graduates and specialists as they share their advice for students considering a career in cyber.
We're hiring: Technology Controls Assurance Senior Analyst
11/08/2026 06:49 Filed in: Posts
📍 Sydney (Hybrid) | 🏦 Financial Services | 🔐 Technology Risk, Controls & Assurance
We’re hiring a Technology Controls Assurance Senior Analyst to help strengthen confidence across AMP’s technology, cyber, third-party and AI risk environment.
This is a key role within Security, Risk & Compliance, focused on delivering risk-based assurance reviews across AMP’s technology landscape. You’ll work closely with stakeholders across Technology, Risk, Assurance and the broader business to provide independent, practical and insightful assurance over the areas that matter most.
You’ll be involved from planning through to reporting, assessing the design and effectiveness of controls, identifying emerging risks, and translating regulatory and industry developments into meaningful assurance activity. You’ll also help improve our assurance methodologies, workpaper quality and ways of working as the function continues to evolve.
You’ll be a strong fit if you bring:
* Experience in technology risk, cyber assurance, technology audit, internal audit, risk consulting or technology risk management.
* Exposure to cloud security, third-party risk, information security controls or emerging technology risk.
* Familiarity with frameworks such as ISO 27001, NIST CSF, COBIT, SOC reporting and APRA prudential standards.
Strong stakeholder management, communication and influencing skills.
This role offers the opportunity to have real impact in a function that is evolving how assurance is delivered, with the autonomy to help shape a collaborative and high-performing team.
➡️ Apply now: Technology Control Assurance Senior Analyst
We’re hiring a Technology Controls Assurance Senior Analyst to help strengthen confidence across AMP’s technology, cyber, third-party and AI risk environment.
This is a key role within Security, Risk & Compliance, focused on delivering risk-based assurance reviews across AMP’s technology landscape. You’ll work closely with stakeholders across Technology, Risk, Assurance and the broader business to provide independent, practical and insightful assurance over the areas that matter most.
You’ll be involved from planning through to reporting, assessing the design and effectiveness of controls, identifying emerging risks, and translating regulatory and industry developments into meaningful assurance activity. You’ll also help improve our assurance methodologies, workpaper quality and ways of working as the function continues to evolve.
You’ll be a strong fit if you bring:
* Experience in technology risk, cyber assurance, technology audit, internal audit, risk consulting or technology risk management.
* Exposure to cloud security, third-party risk, information security controls or emerging technology risk.
* Familiarity with frameworks such as ISO 27001, NIST CSF, COBIT, SOC reporting and APRA prudential standards.
Strong stakeholder management, communication and influencing skills.
This role offers the opportunity to have real impact in a function that is evolving how assurance is delivered, with the autonomy to help shape a collaborative and high-performing team.
➡️ Apply now: Technology Control Assurance Senior Analyst
We’re hiring: Senior Security Architect
08/08/2026 08:57 Filed in: Posts
📍 Sydney (Hybrid) | 🏦 Financial Services | 🔐 Security Architecture & Secure by Design
We're hiring a Senior Security Architect to help shape and strengthen AMP's security architecture capability at a pivotal time in our technology transformation journey. You’ll play a key role in ensuring security is embedded into how we design, build and operate technology across the enterprise.
This is a strategic and hands-on role focused on Secure by Design, security architecture, and enabling innovation in a highly regulated environment. You'll work closely with business, technology and risk teams to translate complex requirements into practical security outcomes that support both resilience and growth.
You'll be responsible for delivering security architecture services, influencing technology decisions, and helping maintain AMP's enterprise security architecture standards and patterns. Working across cloud, applications, platforms and emerging technologies, you'll help protect the trust our customers place in us every day.
You'll be a strong fit if you bring:
* Experience in security architecture within financial services or other highly regulated industries
* Strong knowledge of security frameworks and regulatory requirements such as NIST, ISO 27000-series and APRA CPS 234
* Experience embedding Secure by Design principles into technology delivery and transformation initiatives
* The ability to balance security, risk and business outcomes while influencing senior stakeholders across technology and business teams
This role offers the opportunity to influence security outcomes across AMP's technology landscape, work alongside a high-performing team, and help shape the future of a modern financial services organisation.
➡️ Apply now: Senior Security Architect
We're hiring a Senior Security Architect to help shape and strengthen AMP's security architecture capability at a pivotal time in our technology transformation journey. You’ll play a key role in ensuring security is embedded into how we design, build and operate technology across the enterprise.
This is a strategic and hands-on role focused on Secure by Design, security architecture, and enabling innovation in a highly regulated environment. You'll work closely with business, technology and risk teams to translate complex requirements into practical security outcomes that support both resilience and growth.
You'll be responsible for delivering security architecture services, influencing technology decisions, and helping maintain AMP's enterprise security architecture standards and patterns. Working across cloud, applications, platforms and emerging technologies, you'll help protect the trust our customers place in us every day.
You'll be a strong fit if you bring:
* Experience in security architecture within financial services or other highly regulated industries
* Strong knowledge of security frameworks and regulatory requirements such as NIST, ISO 27000-series and APRA CPS 234
* Experience embedding Secure by Design principles into technology delivery and transformation initiatives
* The ability to balance security, risk and business outcomes while influencing senior stakeholders across technology and business teams
This role offers the opportunity to influence security outcomes across AMP's technology landscape, work alongside a high-performing team, and help shape the future of a modern financial services organisation.
➡️ Apply now: Senior Security Architect
💡 Personal Access Tokens Have No Place In Modern Development Pipelines
🔑 Personal Access Tokens (PATs) have quietly become the default way we connect systems, and as often, that default deserves a lot more scrutiny than it gets.
They're convenient: no consent screen, no session to manage, a single string that just works. But that same simplicity is exactly what makes them dangerous: long-lived, broadly scoped, and largely invisible to the identity controls we've already invested in. Now, a run of recent breaches all trace back to exactly this credential pattern. 🔓
In this article, I look at why PATs have become the path of least resistance across the industry (often because the platforms we build on make it the easy choice), why that convenience is the vulnerability, and where I land: PATs should be a narrow, governed exception, not the design default in a modern development pipeline.
ISACA Sydney Chapter July Forum
It’s always a pleasure hosting the ISACA Sydney Chapter at AMP. A big thank you to Neethu N. and Yashaswini P. for sharing their insights on security, AI, and governance. Great discussions and perspectives from across the community.
Factor CIO Conference
Last week at the Factor CIO Conference in Melbourne, Julia P. and I explored a topic that continues to shape how organisations respond to cyber risk: security is not simply about stronger controls or better detection capabilities. It is about how effectively first and second line teams work together when pressure is high, time is limited, and the trade-offs are real.
Organisations that navigate these moments well do not treat cyber security as a siloed function. They establish clarity early, create shared accountability, and focus on what matters most: maintaining resilience, protecting customers, and enabling better decisions at speed.
Reflecting on that discussion, I captured some of my thoughts in the article Cyber Risk is a Trade-Off Problem.
Organisations that navigate these moments well do not treat cyber security as a siloed function. They establish clarity early, create shared accountability, and focus on what matters most: maintaining resilience, protecting customers, and enabling better decisions at speed.
Reflecting on that discussion, I captured some of my thoughts in the article Cyber Risk is a Trade-Off Problem.
💡 Cyber Risk is a Trade-Off Problem
Most of our cyber conversations still focus on tools, controls, and patching speed, even though we all know it rarely resonates with our audiences.
In this piece, I explore a different lens: cyber risk as a series of trade-off decisions, not technical fixes.
From incident response to patching, the real question isn’t “what’s the fix?”
It’s “what are we willing to trade off to get the outcome we want?”
If you’re involved in security, risk, or leadership, this shift in thinking matters more than ever.
We’re hiring: Principal, Entreprise AI Risk
19/06/2026 14:32 Filed in: Posts
📍 Sydney (Hybrid) | 🏦 Financial Services | 🤖 AI Risk & Governance
We’re hiring a Principal, Enterprise AI Risk to establish and mature AMP’s approach to AI risk at an important point in our AI adoption journey.
This is a strategic role focused on governance, transparency and accountability. You will own the end‑to‑end AI risk and compliance process, embed the Responsible AI Framework, and provide clear insight to executives on AI risk posture and priorities.
You’ll work across business, technology and risk to ensure AI is used in line with risk appetite and regulatory expectations, while enabling adoption at scale.
You’ll be a strong fit if you bring:
This role offers direct impact on how AI is governed across AMP, with the autonomy to shape a capability that is still evolving.
➡️ Apply now: Principal, Entreprise AI Risk
We’re hiring a Principal, Enterprise AI Risk to establish and mature AMP’s approach to AI risk at an important point in our AI adoption journey.
This is a strategic role focused on governance, transparency and accountability. You will own the end‑to‑end AI risk and compliance process, embed the Responsible AI Framework, and provide clear insight to executives on AI risk posture and priorities.
You’ll work across business, technology and risk to ensure AI is used in line with risk appetite and regulatory expectations, while enabling adoption at scale.
You’ll be a strong fit if you bring:
- Experience in enterprise risk, governance or compliance in regulated environments
- A track record in AI risk, responsible AI or governance frameworks
- The ability to translate complex risk into practical decisions and actions
- Strong executive communication and stakeholder influence
This role offers direct impact on how AI is governed across AMP, with the autonomy to shape a capability that is still evolving.
➡️ Apply now: Principal, Entreprise AI Risk
FS-ISAC Forum in Melbourne
A highly engaging FS-ISAC forum in Melbourne today, hosted by AMP.
The sessions focused on learning from other industries and exploring how those insights can be applied within financial services. It was a valuable reminder that many of the challenges we face are not unique, and cross-industry collaboration can unlock new ways of thinking about resilience and risk.
I also had the opportunity to present on the intersection of geopolitics and cybersecurity. We discussed how global tensions, shifting alliances, and regulatory fragmentation are increasingly shaping the threat landscape, and more importantly, what organisations can do to prepare. Building geopolitical awareness into cybersecurity strategy is no longer optional; it is becoming a core capability.
Thanks Lachlan P., Steve E., Ciara C. and Ashish P. for making it happen!
The sessions focused on learning from other industries and exploring how those insights can be applied within financial services. It was a valuable reminder that many of the challenges we face are not unique, and cross-industry collaboration can unlock new ways of thinking about resilience and risk.
I also had the opportunity to present on the intersection of geopolitics and cybersecurity. We discussed how global tensions, shifting alliances, and regulatory fragmentation are increasingly shaping the threat landscape, and more importantly, what organisations can do to prepare. Building geopolitical awareness into cybersecurity strategy is no longer optional; it is becoming a core capability.
Thanks Lachlan P., Steve E., Ciara C. and Ashish P. for making it happen!
💡 Claude Mythos and the Next Shift in Cyber Security
Feels like every CISO must have an opinion on Claude Mythos these days… so here’s mine 😄
This article is a quick take on what Mythos means for organisations and what cyber security teams will have to do to respond.
