Senior Audit Manager Information Security

• Lead and deliver a portfolio of security audits across the banks technology estate.
• Showcase your coaching skills to develop a small team of audit professionals.
• A growing focus of this role is assurance over the banks AI and agentic AI estate.

Our people are customer obsessed. They prioritise the needs and satisfaction of the customer above all else. Our mindset fosters innovation and creates strong lasting customer relationships as we strive to be the most customer centric company in Australia and New Zealand.

In the role of Senior Audit Manageryoull join NABs Internal Audit team thats doubling down on winning together.

Each day you will go above and beyond to:

• Assess controls across SIEM/SOAR EDR/XDR proxy and web gateways DLP PAM IAM network segmentation firewalls WAF email security vulnerability management and threat hunting capabilities.
• Lead and deliver security audits end-to-end including scoping control walkthroughs testing design evidence evaluation finding development and report drafting to executive quality.
• Assess the security of AI and agentic AI systems including frontier model guardrails prompt injection defences MCP server and tool brokering controls agent identity and access management RAG pipeline security vector store protection and model output validation.
• Build and maintain strong connections with CISO CIOs senior technology leaders and industry peers.
• Ensure audits adhere to APRA CPS 234 CPS 231 ISO 27001 NIST CSF and other relevant standards. Provide clear assurance over compliance obligations.
• Identify systemic control breakdowns and provide actionable risk-based recommendations to enhance cyber maturity.

What you will bring:

• Strong grounding in core security principles including defence-in-depth principle of least privilege zero trust segregation of duties secure-by-design and threat modelling and the ability to apply them consistently in audit judgement.
• Ability to rapidly understand any system or architecture and identify where controls should sit from SIEM/SOAR ingestion and correlation EDR/XDR coverage and response secure web gateways and proxy solutions DLP email security PAM IAM network segmentation firewalls WAF and data protection tooling.
• Understanding of AI and agentic AI security including Frontier model consumption patterns and the security guardrails that govern their safe use (input and output filtering prompt injection defences jailbreak resistance content and safety classifiers response validation).
• Deep understanding of Model Context Protocol (MCP) and MCP brokering including the risks arising from tool exposure server trust boundaries credential handling and scope of delegated access.
• Profound years of experience across technology audit technology risk engineering or architecture roles within financial services or other large regulated industries.
• Certifications strongly desirable one or more of: GCIH GCFA GNFA CISSP OSCP or equivalent credentials in defensive security.

A diverse and inclusive workplace works better for everyone

We know that when our colleagues feel valued and celebrated for who they are our customers experience banking thats fairer more accessible and designed with who they are in mind. Thats why weve built a culture of inclusion and respect where colleague voices are heard and valued and everyone is supported to bring their authentic selves to work.

For details on the recruitment process and accessibility or alternate methods to apply for this role please visit To discuss adjustment requirements please contact the NAB Careers team via (please reference job number) or visit our Careers page through the link above for other contact options.

Join NAB

At NABwerecommitted to supporting our colleagues with a comprehensive range of benefits designed to help you thrive both professionally and personally including enhanced leave options wellbeing support access to NAB Perks and ongoing career development opportunities. If you think this role is the right fit for you we would love to hear from you. Please note candidate screening and interviews may be conducted prior to the closing date of the job advert. Unsolicited CVs from agencies will not be accepted.