Chief Information Security Officer

A Chief Information Security Officer (CISO) leads and directs an organisation's information security strategy, governance, and risk management programmes. They oversee the design, implementation, and maintenance of security controls across IT systems and data assets, ensuring compliance with Australian regulatory frameworks including the Privacy Act 1988, Notifiable Data Breaches (NDB) scheme, and relevant industry standards. The role involves boardroom-level responsibility for managing cybersecurity threats, incident response, and strategic alignment of security initiatives with business objectives.

Develop and oversee the organisation's information security strategy, policies, and frameworks aligned with business goals and Australian regulatory requirements. Establish security governance structures and accountability mechanisms across the organisation, including security committees and risk oversight boards. Assess and prioritise security risks using threat modelling, vulnerability assessments, and penetration testing to inform investment decisions. Oversee the implementation and maintenance of security controls across IT infrastructure, including network segmentation, access management, encryption, and endpoint protection. Lead incident response planning and coordinate response activities during security breaches, including notifications under the Privacy Act Notifiable Data Breaches scheme. Ensure compliance with Australian regulatory requirements including the Privacy Act 1988, APPs (Australian Privacy Principles), PSPF (Protective Security Policy Framework) for government agencies, and sector-specific standards such as PCI-DSS or APRA's CPS 234 where applicable. Manage third-party security assessments and vendor risk management programmes to evaluate the security posture of critical suppliers and cloud service providers. Direct security awareness and training programmes across the organisation to establish a security-conscious culture and meet compliance obligations.

The standard entry pathway requires a bachelor degree or higher (ABS Skill Level 1). Specific qualification requirements vary by employer and state. Some employers may accept equivalent experience. Check yourcareer.gov.au for available courses and dewr.gov.au/skills-reform/free-tafe for subsidised training options.

You'll need 10 to 15 years in security roles before companies trust you at this level. The certification pathway is brutal: CISSP, CISM, or equivalent takes 18 months minimum alongside full-time work. You're on-call during breaches (3am incidents happen). Some people find the pay does not match the stress. Career changers from unrelated fields struggle most.

Practically: most roles cluster in CBD areas where big corporates and banks are. Government agencies (Defence, Treasury) have dedicated positions. Remote work exists but rare: companies want you onsite during crises. Regional Australia has almost none.

Published for ANZSCO unit group 1351, the wider group this job sits in, not for this job on its own.

This is the median for full-time employees who are not managers and are paid at the adult rate, before tax and salary sacrifice. It is a guide to what the work pays, not a wage rate.

Source: ABS Survey of Employee Earnings and Hours, May 2025, customised report.

• Confidentiality and Privacy Compliancecore
• Incident Reportingcore
• Negotiationcore
• Policy and Procedure Adherencecore
• Policy Interpretationcore
• Problem Solvingcore
• Process Improvement Identificationcore
• Regulatory and Legislative Awarenesscore
• Report Writingcore
• Reporting and Analyticscore
• Research and Analysiscore
• Risk Identificationcore
• Stakeholder Communicationcore
• Verbal Communicationcore
• Written Communicationcore
• Continuous Learning and Upskilling
• Digital Literacy
• Escalation Management
• Goal Setting and Planning
• Power BI Reporting and Dashboards
• Process Documentation
• Quality Assurance Monitoring
• Team Collaboration

• ABS OSCA 2024, occupation definition and task statements
• ABS Survey of Employee Earnings and Hours, May 2025, customised report.
• ABS, 2021 Census of Population and Housing based on usual place of residence (Custom Report). OSCA Experimental Estimates.

Role data is drawn from official Australian Government sources, and each figure names where it comes from. Where a role is not in the ABS classification, the page shows no government figures for it. Data may not reflect every local variation.

Where our numbers come from.

What Chief Information Security Officer workers move into, from ten years of tax records.

Last updated: 30 October 2026