Sourcing Strategy: Cyber Security Risk Analyst | Commonwealth Government | Canberra
Role Context & Sourcing Challenges
This role presents a specific talent challenge: it sits at the intersection of government-specific regulatory knowledge (PSPF, ISM, Essential Eight) and hands-on technical depth (Azure, legacy systems, AI). The Canberra market for cleared or clearance-eligible cyber talent is competitive, relatively small, and heavily relationship-driven. Candidates with genuine government risk assessment experience are rarely active on job boards — they need to be found and engaged directly.
1. Target Candidate Profile
Before sourcing, get clear on the tiers:
- Tier 1 (Ideal): Current or recent government-side cyber analyst with direct SSP/SSP-A writing experience, active clearance (Baseline or above), and PSPF/ISM delivery experience in an APS or contractor capacity
- Tier 2 (Strong): Private sector consultant who has delivered risk assessments for government clients (e.g. via a Big 4, boutique cyber firm, or MSSP) with demonstrated framework knowledge
- Tier 3 (Developable): Strong cyber risk professional from defence industry or critical infrastructure with transferable skills and clearance eligibility
2. LinkedIn Sourcing
This is the primary active sourcing channel. Run Boolean searches targeting:
- Keywords: "security risk assessment", "SSP", "PSPF", "ISM", "Essential Eight", "information security", "cyber security analyst"
- Location filter: Canberra / ACT
- Current/past employers to target:
- APS agencies (ASD, Home Affairs, Defence, AGD, Services Australia, ATO)
- Big 4 cyber practices (Deloitte, KPMG, PwC, EY — all have Canberra government cyber teams)
- Boutique cyber firms: CyberCX, Sekuro, Tesserent, Dvuln, Trustwave
- Defence primes: Leidos, BAE Systems, Boeing Defence Australia, Northrop Grumman, L3Harris
- MSSPs and cloud-native firms with government clients: Datacom, DXC, NTT, Fujitsu
Sample Boolean string:
("cyber security" OR "information security") AND ("risk assessment" OR "SSP" OR "PSPF" OR "ISM") AND ("government" OR "APS" OR "Commonwealth")
Prioritise candidates with profile activity in the last 90 days. Send personalised connection requests referencing their specific experience — avoid generic InMail templates.
3. SEEK & Job Board Strategy
- Post on SEEK using the optimised job title with framework keywords in the title and body to maximise search ranking
- Mirror the ad on LinkedIn Jobs — this is increasingly where government-adjacent contractors search
- Consider Ethical Jobs or APSJobs adjacent promotion if the agency approves indirect referencing
- Tag the SEEK ad with relevant classifications: Information & Communication Technology > Security, with Canberra as the work location
Refresh or re-post at the two-week mark if application volume is low — SEEK listings drop in visibility after 14 days.
4. Internal Database & Warm Pipeline
Before going to market externally, work the existing Resolve database first:
- Search for candidates tagged with: cyber, ISM, PSPF, SSP, Essential Eight, security risk, government
- Filter for ACT-based or Canberra-willing candidates
- Cross-reference against any candidates who have come through DAFF, Home Affairs, AGD, or ASD roles previously — they are the most likely profile match
- Check candidates who were submitted but not placed in recent cyber roles at ACIC, NACC, AFP, and ASD — they may still be available or looking
This should be the first 24 hours of activity.
5. Referral Activation
Cyber in Canberra is a tight community. Tap your existing contractor network directly:
- Contact current and recently placed contractors in cyber or security-adjacent roles and ask for referrals — offer a referral incentive if Resolve's programme allows
- Ask candidates who are not the right fit for this role whether they know someone who is
- Post a targeted referral prompt on LinkedIn from your personal profile (not just the Resolve page) — your network skews toward exactly the audience needed here
6. Community & Event Channels
- ISACA Canberra Chapter — highly relevant community; members are often working practitioners in exactly this space. You've previously attended an ISACA subsea cable event, so the relationship is warm. Consider posting in their community channels or reaching out to the chapter lead
- AustCyber / Cyber Security CRC networks — worth a post or direct outreach
- ACT Cyber Security meetups and events — monitor Eventbrite and Meetup.com for upcoming events where passive candidates may be present
- University of Canberra / ANU cyber alumni networks — useful for Tier 3 candidates if Tier 1 and 2 supply is thin
7. Screening & Qualification Framework
Given the volume of cyber candidates who overstate framework knowledge, build a quick phone screen qualifier:
| Question | What you're assessing |
|---|---|
| Can you walk me through the last SSP or SSP-A you contributed to? | Genuine hands-on documentation experience |
| How do you approach a risk assessment for a system that spans both cloud and legacy infrastructure? | Technical depth and structured thinking |
| What's your current clearance level and when was it last activated? | Clearance status and recency |
| Have you presented findings to SES or equivalent? | Executive communication experience |
| What's your familiarity with the current ISM controls and how they map to Essential Eight maturity levels? | Framework currency |
Flag candidates who speak only in generalities — this role requires demonstrated, specific delivery experience.
8. Timeline & Activity Cadence
| Day | Activity |
|---|---|
| Day 1 | Database search, warm pipeline calls, LinkedIn Boolean search saved |
| Day 2–3 | Direct LinkedIn outreach (target 30–40 personalised messages) |
| Day 3 | SEEK and LinkedIn Jobs live, referral asks activated |
| Day 5–7 | First round phone screens underway |
| Day 10 | Shortlist of 3–5 candidates compiled for client review |
| Day 14 | SEEK refresh if needed; follow up on outstanding LinkedIn responses |
| Day 22 | Application close |
Key Watch-Outs
- Candidates may have NV1 or above clearances that are inactive — clarify reactivation timelines upfront with the client so this doesn't kill an otherwise strong submission
- Some strong candidates will be on existing contracts ending soon — worth asking about notice periods and contract end dates even if they say they're not actively looking
- The 1.5-year government experience threshold in the essential criteria is relatively accessible — don't over-filter on this; focus on quality of experience over raw tenure