Key takeaways
- CPS 234 sets expectations for information security capability; CPS 230 covers operational resilience and service providers.
- Resilience, third-party risk and controls skills are now part of many non-security roles.
- Candidates with hands-on APRA experience are scarce — brief early.
Two standards, one theme: resilience
APRA's CPS 234 requires regulated entities to maintain information security capability that matches the threats they face. CPS 230, in force since 1 July 2025, covers operational risk management, business continuity and the management of material service providers.
Together they push banks, insurers and super funds to prove they can keep critical operations running — and that the people and providers behind those operations are up to the job.
How job descriptions are changing
- Security roles increasingly include controls testing and evidence for CPS 234 reviews.
- Technology and platform roles now carry resilience responsibilities — recovery testing, tolerance levels and incident playbooks.
- Vendor and procurement roles need third-party risk experience to manage material service providers under CPS 230.
- Program roles are being created to deliver uplift and remediation work.
Skills in demand
- Technology risk and GRC analysts with APRA experience
- Security controls testers and assurance specialists
- Business continuity and resilience leads
- Third-party and supplier risk specialists
- Cloud architects who can design for recoverability
Building the team
Uplift programs often need contract specialists quickly, followed by permanent hires to run the new controls. Our banking and financial services team recruits for both — see how we deployed 10 RPA specialists in 45 days for a leading Australian bank.
Need help with this?
Talk to a specialist recruiter about your role — we'll come back within one business day.