SMO System Manager - Compliance & Security Governance

About the role

NCS is looking for an SMO System Manager for Governance & Compliance, IT Security & Compliance to lead service governance, IT security compliance and risk management for a Defence client environment. This is a client-facing role sitting at the intersection of service management, cybersecurity governance, compliance and operational security assurance, working with project teams, client stakeholders, auditors, agency security teams, internal delivery teams and Partners. It is a Day 2 role.

Key responsibilities

• Lead governance, risk and compliance activities across the project team and service environment.
• Oversee IT security and compliance, including security controls, compliance tracking, audit readiness, remediation follow-up and risk reporting.
• Manage service management governance across incident, problem, change, release, configuration and service continuity processes.
• Act as the key point of contact for security incidents, coordinating escalation, reporting and closure.
• Review and guide security and compliance artefacts such as government security submissions, risk papers, control documents and clearance papers, and support CSA Tier 1 and GHT papers where applicable.
• Drive compliance with ITIL, IM8, CIS Controls, ISO 27001 and other government security requirements.
• Monitor vulnerabilities (CVE and known exploited exposures) and coordinate remediation with technical teams.
• Prepare governance reports, compliance updates, risk registers, audit responses and management summaries.

Required profile

• Strong experience in IT service management, cybersecurity governance, IT security compliance, risk management or audit coordination.
• Prior experience in Defence, public service or government-regulated environments highly preferred.
• Good understanding of ITIL-based service management processes.
• Able to engage confidently with client teams, auditors, agency security representatives, project and technical teams and Partners.
• Strong writing and review skills for governance papers, compliance documentation and audit responses.
• Experience with CSA Tier 1, GHT or other clearance papers is an advantage; knowledge of the CSA Cloud Controls Matrix is optional but beneficial.

Required skills

• ITIL, IM8, CIS Controls, ISO 27001, CVE tracking and vulnerability management.
• Preferred certifications: CISSP, CISA or CISM; ITIL 4 or ITIL 5; ISO 27001 Lead Implementer / Implementer.