Chief Information Security Officer

Cyber Security & Information Security Management

• Establish, own, and continuously improve RedShield's Information Security Management System (ISMS),

ensuring alignment with ISO 27001, SOC 2, and applicable regulatory frameworks.

• Develop, implement, and maintain security policies, standards, and procedures across the organisation,

ensuring they are embedded in day-to-day operations and understood by all staff.

• Lead RedShield's security incident response programme, including the development of incident response

plans, tabletop exercises, and post-incident reviews to drive continuous improvement.

• Oversee and manage RedShield's internal security posture — including vulnerability management, patch

• management, and security hardening across systems, applications, and cloud infrastructure.
• RedShield Security · Chief Information Security Officer · Page 1

Commercial in Confidence

• Drive a culture of security awareness throughout the organisation, designing and delivering training and

awareness programmes that equip staff to identify and respond to threats.

Security Research & Threat Intelligence

• Rebuild and lead RedShield's security research capability, establishing a programme of proactive vulnerability

• research and CVE discovery that reinforces RedShield's reputation as an expert authority in application
• security.

• Develop and maintain a threat intelligence programme that monitors the evolving threat landscape,

translating intelligence into actionable risk insights for the business and its customers.

• Oversee the development and publication of security research, threat advisories, and vulnerability disclosures

in accordance with responsible disclosure standards.

• Ensure security research capabilities are aligned to RedShield's product and service strategy, contributing to

the development of new and enhanced service offerings.

• Foster relationships with the broader security research community, academic institutions, and government

bodies to ensure RedShield remains at the forefront of emerging threat knowledge.

Testing & Assurance

• Oversee the delivery of vulnerability assessment capabilities, including testing of controls, ensuring

methodologies, standards, and reporting meet the highest professional benchmarks.

• Ensure rigorous quality assurance processes are applied to all testing and assurance outputs, maintaining

RedShield's standard of excellence and customer trust.

• Lead the development and continuous improvement of testing methodologies, tools, and frameworks,

including red team and purple team exercises where appropriate.

• Work with the Customer and Technology pillars to embed security assurance into the delivery lifecycle,

ensuring testing insights contribute to customer security improvement programmes.

Technology Risk & Compliance

• Develop and maintain a comprehensive technology risk framework and risk register, ensuring all material risks

are identified, assessed, and managed in line with RedShield's risk appetite.

• Lead RedShield's compliance programme, ensuring ongoing adherence to relevant regulatory requirements,

• industry standards, and contractual obligations across all jurisdictions in which RedShield operates (New
• Zealand, Australia, United States).

• Manage third-party and supply chain risk assessments, ensuring that vendors and partners meet RedShield's

security and compliance requirements.

• Provide regular risk and compliance reporting to the CEO and Board, delivering clear, concise insights that

enable informed decision-making at the executive and governance level.

• Monitor the regulatory environment for changes that may impact RedShield's compliance obligations,

proactively developing plans to address emerging requirements.

Government Assurance & Certification

• Own RedShield’s continuous NZISM certification and accreditation programme for services delivered to New

Zealand Government agencies, based on ongoing security risk management.

• Own IRAP (Infosec Registered Assessors Program) assessment planning, evidence preparation, remediation

• tracking and assessor engagement to maintain and renew RedShield’s IRAP-assessed posture at the
• PROTECTED classification level.

• Ensure compliance with the Australian Government Information Security Manual (AU ISM) and alignment with

the Protective Security Policy Framework (PSPF) for Australian Government agency services.

• Ensure timely notification of cyber security incidents to the Australian Signals Directorate (ASD) and Australian

Cyber Security Centre (ACSC) in line with PSPF Policy 10 and applicable mandatory obligations.RedShield Security · Chief Information Security Officer · Page 2

Commercial in Confidence

Internal Audit

• Develop, manage, and execute RedShield's internal audit programme, providing independent assurance over

the effectiveness of internal controls, risk management processes, and governance frameworks.

• Report audit findings clearly and objectively, working constructively with business owners to agree

remediation actions and track delivery to resolution.

• Act as RedShield's primary liaison for external audit processes, regulatory examinations, and certifications,

coordinating evidence gathering and response activities across the organisation.

• Ensure audit findings and control gaps are remediated in a timely and effective manner, escalating material

issues to the CEO and Board as appropriate.

Team Leadership & Development

• Build, lead, and develop the Security pillar team — initially comprising the InfoSec Manager, we have

• identified key roles across security research, penetration / controls testing and security engineering we need
• to recruit with an expectation that the team will grow as RedShield scales.

• Recruit and onboard new Security team members with a focus on technical excellence, cultural fit, and

alignment to RedShield's mission.

• Foster a high-performance, collaborative team culture that balances rigour and discipline with innovation and

continuous learning.

• Ensure all Security team members have clear goals, regular feedback, and meaningful development

opportunities aligned to their career aspirations and RedShield's strategic needs.

• Ensure all work is tracked, prioritised, and delivered in an organised manner through appropriate sprint

planning, work allocation, and project management practices.

• Collaborate closely with the Chief Technology Officer to ensure alignment between the Security pillar and the

• Technology pillar, particularly on matters of infrastructure security, cloud architecture, and security
• engineering.

Customer Trust & Commercial Enablement

• Act as RedShield’s senior security authority in strategic customer engagements, executive briefings and

Quarterly Business Reviews, articulating RedShield’s security posture and value.

• Own customer-facing security assurance collateral — trust packs, certifications, and responses to customer

security questionnaires and due-diligence requests.

• Support the Customer and Commercial pillars on security aspects of RFPs, contracts and pre-sales

• engagements, translating RedShield’s internal security maturity into a demonstrable commercial
• differentiator.

• Use RedShield’s own ‘beyond reproach’ security posture as a proof point that reinforces customer trust and

supports revenue growth.

Qualifications & Experience

• 5+ years of experience in senior cyber security roles, including demonstrable experience leading security

functions within technology businesses or managed security service providers.

• Proven experience in controls testing and assurance, vulnerability assessment, or offensive security, with the

ability to lead and quality-assure technical testing programmes.

• Demonstrated experience designing and implementing an ISMS aligned to ISO 27001 and/or SOC 2, including

policy development, control implementation, and certification management.

• Strong background in technology risk management, including risk framework development, risk register

management, and risk reporting to executive and board-level stakeholders.

• Experience managing or overseeing internal audit programmes, with the ability to deliver independent

assurance across complex operational and technology environments.

• Demonstrated leadership of technical security teams, including recruitment, performance management, and

professional development of security professionals.

• Excellent communication and stakeholder management skills, with the ability to present complex security and

risk topics clearly to non-technical executive and board audiences.

Key Competencies

• Strategic Security Leadership: Demonstrated ability to develop and execute a forward-looking security

• strategy that is aligned to business objectives, builds organisational resilience, and positions RedShield as a
• trusted security authority.

• Technical Depth: Deep technical expertise across cyber security domains including controls testing,

• vulnerability research, cloud security, identity and access management, and application security — with the
• credibility to lead highly skilled technical teams.

• Risk & Compliance Acumen: Comprehensive understanding of technology risk frameworks, compliance

• standards (ISO 27001, SOC 2, NZISM), and regulatory obligations, with the ability to translate risk insights into
• actionable management decisions.

• Team Building & Development: Proven experience building high-performing security teams from the ground

• up, with a track record of attracting talent, developing capability, and fostering a culture of excellence,
• learning, and accountability.

• Stakeholder Engagement & Communication: Exceptional ability to communicate complex security and risk

• matters clearly and persuasively to diverse audiences — from technical practitioners to CEO and Board —
• building confidence and enabling informed decision-making.

• Operational Discipline: Skilled in establishing and maintaining rigorous security operations, audit processes,

• and reporting cadences, ensuring the Security pillar delivers consistently high-quality outputs in a structured,
• accountable manner.