Summary of This Role

Develops and leads one or more of the following highly technical and specialized areas within information security: Security Engineering, Security Architecture, Forensics Analysis, Threat Analysis, Threat Hunting and Penetration Testing. Manages the development, deployment and execution of enterprise security controls and defenses. Monitors, analyzes and exploits system vulnerabilities to detect potential threats. Executes containment, mitigation and protection processes to safeguard against real time threats while maintaining critical documentation and evidence. Determines risk and exposure from security breaches and resolves incidents while providing guidance to business decision-makers.

What Part Will You Play?

• Delivers advanced information security solutions to align security solutions with strategic business goals. Guides the technical review of security controls for processes, solutions and technologies for third party assurance, corporate compliance and internal and external data security obligations.
• Approves enterprise level development projects. Contributes to the development and implementation of short-term architectural roadmap to reduce risk associated with known and emerging information security threats across the enterprise. Executes information security's architectural strategy for managing risk across the enterprise.
• Reviews investigation reports and translates findings to identification of future risks and actionable plans to protect the enterprise. Issues gap analysis reports that measure the security posture of the organization and partners. Acts as an escalation point and decision maker for all major security incidents across the enterprise.
• Directs cyber security research efforts to continually adapt processes and technologies in order to meet an ever changing threat landscape. Partners with internal and external experts to develop advanced threat detection techniques leveraging emerging technologies.
• Provides actionable intelligence and recommendations to enable security resources to more effectively prioritize protections against cyber threats. Reviews and approves threat assessment required control definitions and procedure appropriateness. Guides the development of on-going Information Security monitoring programs to regularly measure control effectiveness.
• Organizes high profile hacking scenarios involving internal and external experts to validate enterprise wide system integrity and data confidentiality. Defines and implements guidelines to ensure accurate and complete documentation and reporting. Assists management in continuously enhancing the organization’s security frameworks, standards and principles.
• Reviews security solution recommendations to ensure security risks are appropriately controlled and services remain in compliance with internal and regulatory security policies and standards. Validates new user needs or program enhancements and implements appropriate security plans and control techniques. Simplifies complex and challenging concepts for stakeholders, documenting and presenting the required control frameworks and gaining acceptance. Directs communication with internal counterparts to set priorities for enhanced security reporting and monitoring.
• Not an exhaustive list; other duties as assigned.

What Are We Looking For in This Role?

Minimum Qualifications

• Bachelor's Degree
• Relevant Experience or Degree in: Information Security or Computer Science preferred. Other majors will be considered.
• Typically a minimum of 10 years
• related professional experience including a minimum of 5-6 years experience in a managerial position.
• One or more of the following-CISSP, CISA, CISM, PCI-QSA, PA-QSA, PCIP, CRISC, CGEIT, Certified Forensic Computer Examiner (CFCE), Certified Cyber Threat Analyst (CCTA), Certified Computer Examiner (CCE)

Preferred Qualifications

• Master's Degree
• related field of study from an accredited university.
• Prior Global Payments, payment or technology industry experience is preferred.

What Are Our Desired Skills and Capabilities?

• None IdentifiedJoin a collaborative team that enables REA to manage cyber risk confidently while supporting secure business growth
• Lead cyber security risk assessments across products, platforms and key initiatives
• Permanent role based in Melbourne 

We're REA 

With bold and ambitious goals, REA Group  is changing the way the world experiences property. No matter where you're at on your property journey, we're here to help with every step - whether that's finding or financing your next home. 

Our people are the key to our success. At the heart of everything we do, is a thriving culture centred around high performance and care. We are purpose driven and collaborative, which drives innovation and our ability to make a real impact. As such, we’re proud to have been named one of Australia’s Best Workplaces four times since 2021 — including third place in 2025 — plus Best Workplace for Women in 2023 and Best Workplace in Technology in 2024 and 2025. These listings are testament to every person who helps make REA a great place to work.

Where the team fits in

The Cyber Security GRC team provide advice and guidance across governance, risk and compliance, helping teams understand their security responsibilities, assess and treat risks, meet regulatory and contractual obligations, and embed secure-by-design practices into products, platforms and initiatives. We also support security assessments, third-party due diligence, compliance programs, reporting and continuous improvement across REA.

What the role is all about

The Senior Cyber GRC Analyst is a key role within the GRC team and strengthens REA's cyber resilience by leading the identification, assessment and treatment of technology and information security risks, ensuring our products and platforms comply with relevant security, privacy and regulatory requirements, and enabling informed, risk-based decisions that protect our customers, people and brand while supporting sustainable business growth. 

Day to day of the job

• Design, implement and continuously improve cyber GRC frameworks, policies, standards and supporting processes to fit REA's operating model
• Work closely with other teams within REA Security to ensure they are effectively prioritising the building and operation of cyber security controls, in line with the organisation’s risk profile
• Coordinate and oversee control assurance activities (e.g. control testing, audits, attestations) and track remediation through closure. Where possible, automate this assurance work
• Ensure that external compliance obligations and audits are appropriately prepared for and managed
• Provide specialist cyber GRC advice and coaching to technology and product teams to embed secure-by-design and risk-based thinking
• Monitor changes in relevant cyber, privacy and technology standards, contracts and regulations and translate these into practical requirements and guidance for REA
• Prepare and present concise, insightful risk and compliance reporting for technology leadership, risk committees, the board of directors and other stakeholders
• Support third-party and supplier security assessments, including due diligence, ongoing assurance and contract requirement reviews
• Contribute to incident preparedness activities (e.g. playbooks, table-top exercises) and support post-incident reviews from a GRC perspective
• Champion consistent use of cyber GRC tools and data, helping to maintain accurate risk, control and issue registers
• Drive and support uplift initiatives that improve security culture, awareness and ownership of cyber risk across the organisation
• Champion a culture of innovation and automation around GRC

Who we’re looking for

• Significant experience in cyber security governance, risk and compliance, technology risk or related fields, ideally in digital or technology-led organisations
• Demonstrated experience working closely with product and engineering teams to embed security and risk management into delivery practices
• Proficiency with GRC and security tooling (e.g. risk registers, control libraries, workflow tools, vulnerability/issue management platforms) and using data to produce clear risk insights
• Solid understanding of modern cloud and product engineering environments (e.g. AWS, CI/CD, microservices) and common security patterns, controls and failure modes
• Experience coordinating or supporting security audits, certifications or regulatory reviews (e.g. ISO 27001, SOC 2, PCI-DSS or similar)
• Relevant tertiary qualification in Information Security, IT, Risk or related discipline, or equivalent practical experience

The REA experience

The physical, mental, emotional and financial health of our people is something we’ll never stop caring about. This is a place to learn and grow. 

Some of our Perks & Benefits include: 

• A hybrid and flexible approach to working
• Flexible leave options including, birthday leave and purchase additional leave
• Flexible parental leave offering for primary and secondary carers
• Our Because We Care program offers employees volunteering leave, community grants, matched payroll giving and our Community Café donates 100% of revenue to charity
• Hackdays so you can bring your big ideas to life

Our commitment to Diversity, Equity, and Inclusion  

We are committed to providing a working environment that embraces and values diversity, equity and inclusion. We believe teams with diverse ideas and experiences are more creative, more effective and fuel disruptive thinking. If you've got the skills, dedication and enthusiasm to learn but don't necessarily meet every single point on the job description, please still get in touch.

Join our Talent Neighbourhood

Keen to be part of REA but didn't find a perfect match with this opportunity? Perhaps the timing isn't right? You should join our Talent Neighbourhood! 

.