Business Analyst – Cyber Remediation (Critical Infra & Operational Tech)

“OTIC” means smart people doing smart work, together.

We are a wholly owned Australian company based in Melbourne, committed to helping our clients solve complex technology challenges and deliver meaningful business outcomes through exceptional consulting expertise.

Otic Group was established to provide talented technology professionals with the opportunity to work alongside some of Australia’s most recognised organisations while collaborating with highly skilled peers in a dynamic, supportive and growing consulting environment.

Our expertise spans Project Delivery, Data & Analytics, Cloud Strategy, Application Modernisation and Cybersecurity. We work with clients to address some of their most critical technology, risk and security challenges across enterprise and operational environments.

As demand for our cyber security consulting services continues to grow, we are seeking an experienced Senior Business Analyst – Cyber Security Remediation (Critical Infrastructure & Operational Technology) to join our permanent consulting team.

About the Role

This role will support a large-scale cyber security remediation program focused on business-critical and operational technology applications.

Working alongside cyber security specialists, operational technology teams, application owners, infrastructure specialists, vendors and business stakeholders, you will help drive the remediation of identified control gaps across critical systems and assets.

You will play a key role in translating security assessments, risk findings and remediation recommendations into clear requirements, actionable work packages, measurable acceptance criteria and implementation outcomes.

The role requires a highly capable and hands-on Business Analyst who can confidently engage with technical subject matter experts, challenge assumptions, analyse control effectiveness and drive remediation activities through to successful delivery and acceptance.

Experience working within Operational Technology (OT), critical infrastructure, cyber security remediation or regulated environments will be highly regarded.

What You’ll Be Doing

• Analysing cyber security assessments, remediation plans and control-gap findings to define detailed business and technical requirements.
• Working with cyber security, operational technology, infrastructure and application teams to validate current-state controls and identify remediation opportunities.
• Translating remediation activities into functional and non-functional requirements, acceptance criteria and traceability artefacts.
• Facilitating workshops across cyber security, operational, engineering and vendor teams to drive alignment, decision-making and delivery outcomes.
• Supporting remediation initiatives across critical IT and OT applications and supporting infrastructure.
• Collaborating with stakeholders to assess remediation options, implementation approaches and operational impacts.
• Developing operational processes, procedures, playbooks and governance artefacts to support sustainable security uplift outcomes.
• Supporting risk assessment activities and ensuring unresolved gaps, residual risks and treatment options are appropriately documented and understood.
• Partnering with delivery teams to ensure requirements remain aligned throughout design, implementation, testing, evidence collection and acceptance.
• Driving remediation outcomes rather than simply documenting requirements, ensuring initiatives progress through to closure and measurable control uplift.

What We’re Looking For

We’re seeking a Senior Business Analyst with strong cyber security remediation experience and the ability to operate comfortably in complex technical environments.

The ideal candidate will demonstrate:

• Significant Business Analysis experience delivering technology, risk, cyber security or remediation initiatives.
• Proven experience translating control gaps, security findings and remediation recommendations into actionable requirements and deliverables.
• Strong requirements elicitation, process analysis, documentation and acceptance criteria development skills.
• Experience validating current-state controls and working with subject matter experts to identify practical remediation approaches.
• Excellent workshop facilitation skills and the ability to drive technical discussions towards clear outcomes and decisions.
• Strong stakeholder management capabilities, including experience working across security teams, operational stakeholders, vendors and executive audiences.
• Strong risk and control mindset, with the ability to distinguish remediation activities from risk treatment and risk acceptance decisions.
• A delivery-focused approach with proven experience supporting initiatives through implementation, testing, evidence gathering and control acceptance.
• Exceptional communication skills and the ability to translate complex technical concepts into clear business language.

Highly Desirable Experience

Candidates with experience in one or more of the following areas will be highly regarded:

• Operational Technology (OT) environments.
• Critical infrastructure organisations and regulated industries.
• Security of Critical Infrastructure (SOCI) Act compliance initiatives.
• Critical Infrastructure Risk Management Program (CIRMP) activities.
• Industrial control systems and production environments.
• Enterprise cyber security uplift and control-remediation programs.
• Security audit and compliance remediation.
• Security governance and risk management initiatives.

Technical & Security Knowledge

The ideal candidate will possess strong technical literacy and be comfortable engaging with cyber security specialists, architects and engineers across topics such as:

• Security monitoring and logging.
• Identity and access controls.
• Network segmentation and isolation.
• Disaster recovery and resilience capabilities.
• Production and operational technology dependencies.
• Cyber control design and implementation.
• Security evidence and control validation activities.

Experience or knowledge of the following frameworks and standards will also be highly regarded:

• Essential Eight
• NIST Cybersecurity Framework
• SOCI and CIRMP obligations
• Enterprise cyber security control frameworks
• Risk and control assessment methodologies

Why Join Otic?

At Otic, you’ll work with highly capable consultants on some of Australia’s most complex cyber security and technology transformation programs.

You’ll gain exposure to challenging enterprise and critical-infrastructure environments, collaborate with talented industry professionals and have the opportunity to make a meaningful impact on programs that genuinely matter.

Most importantly, you’ll join a team where smart people do smart work, together.

Eligibility Requirements

As a Melbourne-based organisation, we are seeking candidates who are locally based or able to work within the Melbourne market.

Applicants must hold Australian Citizenship, Permanent Residency (PR), or unrestricted permanent Australian work rights.