IT Security Consultant

MinterEllison is one of Australia’s largest independent law and consulting firms. With a heritage of almost 200 years, we are known for our excellence, and our authentic and enduring relationships with our clients, our people and our communities. Clients seek out MinterEllison to help them solve complex problems every day. We do this by our full-service legal offering and complementary consulting offering. We offer opportunities to work on industry-leading mandates for top-tier clients, while being part of a high-performing and collaborative team that values excellence, diversity of thought, curiosity, and inclusion. We value our people and empower them to achieve their ambitions - with the support, trust and autonomy to grow their careers in meaningful ways. At MinterEllison, we're leading the way with AI and other emerging technologies, powering innovation right across our firm. You will have the opportunity to engage with AI tools we've built, and other external AI tools, to enhance efficiencies and excellence internally and with our clients.

Our IT Security team is looking for an IT Security Consultant to deliver technical security risk analysis and assurance activities across MinterEllison's technology environment. The role spans two core functions:

• Technical security risk analysis – including threat and risk assessments, security architecture reviews, and vulnerability analysis;
• Assurance coordination – including client questionnaires, supply chain security, penetration testing oversight, user awareness, and compliance with security standards.

This is an internal role reporting into the IT Security GRC Manager. You will work closely with the broader IT Security team, IT Architecture, IT Operations, IT Procurement, and managed services providers.

Key Responsibilities

• Conduct threat and risk assessments for new and existing systems, applications, and AI solutions, producing structured risk reports with prioritised remediation recommendations.
• Perform security architecture reviews on proposed and existing solutions against MinterEllison standards and applicable frameworks.
• Provide security risk input into IT projects at key stages, ensuring security is embedded by design.
• Analyse vulnerability scan results, triage findings by risk severity, and track remediation to closure.
• Coordinate penetration testing activities including scoping, third-party coordination, and remediation tracking.
• Respond to client questionnaires, audits, security program enquiries, and RFPs.
• Perform supply chain security reviews and maintain the risk register.
• Contribute to the IT Security awareness program and coordinate with broader training teams.
• Assist with maintaining ISO27001 and other compliance certification programs.
• Maintain MinterEllison's Security Trust Centre with regular updates.
• Run quarterly audits on privileged access, user access, mobile device compliance, and asset inventory.
• Assist with security incident response during and after business hours.

Knowledge, Skills and Experience

• At least 2 years' experience in information security or IT risk, with hands-on exposure to technical security assessments.
• Demonstrated ability to conduct structured threat and risk assessments using recognised methodologies (e.g. STRIDE, OCTAVE, NIST RMF).
• Practical exposure reviewing security architectures including cloud security (Azure/M365) and hybrid infrastructure.
• Familiarity with vulnerability management tooling (e.g. Qualys, Tenable, CrowdStrike).
• Excellent knowledge of security frameworks such as ISO27001, SSAE16, APRA CPS234, ASD Essential 8, and NIST v2.0.
• Expert coordination skills with ability to maintain programs on schedule.
• Demonstrated experience writing high quality executive reports/briefings.
• Experience running internal IT audits and supplier assessments.
• Agile mindset with ability to manage tasks independently.
• Relevant certifications highly desirable (CISSP, CISM, CISA, CompTIA Security+, or cloud security certifications).

Personal Attributes

• High integrity and professionalism with excellent communication skills across all levels.
• Self-starter with strong analytical and problem-solving abilities.
• Excellent organisational and time management skills with attention to detail.
• Strategic focus ensuring daily activities add commercial value to the business.

We encourage applications from people of all ages, abilities, cultural backgrounds, genders (including trans or gender diverse), LGBTQ+ people and those with carer responsibilities. We particularly encourage Aboriginal and Torres Strait Islander people to apply.