ASD to create cyber security hubs in three states

The Australian Signals Directorate will create cyber security hubs in Melbourne, Brisbane and Perth after receiving $9.9 billion in the federal budget to boost its offensive and defensive capabilities.

Amid criticism over its plan to double in size over the next decade, director-general Rachel Noble told senate estimates the new hubs would allow the cyber spy agency to tap into a wider talent pool.

“At the moment, given our footprint is largely in Canberra, in order to be willing to join ASD, not only do you need to obtain a security clearance, but you also need to be willing to move to Canberra,” she said.

“REDSPICE [resilience, effects, defence, space, intelligence, cyber and enablers] gives us an opportunity to offer people ongoing roles in Brisbane, Melbourne and Perth, as well as Canberra.

“So, in one respect, that will potentially remove a barrier that people might have to joining ASD.”

Acting deputy-director for corporate and capability Dale Furse told estimates that while ASD is currently working to identify the hubs, they are expected to come online in the next three years.

“We’re looking at finalising [hubs in Melbourne and Brisbane] and having them available in the financial year 2024-25,” he said, adding that Perth would precede that in 2023-24.

Bulk of new staff to join by 2024

But even without the hubs, Noble said she is “quite confident” ASD could add a further 1900 staff to its books over the decade, having grown by 330 staff last year when taking into account turnover.

The comments follow criticism from academics and Labor that ASD would struggle to double in size over the next decade given the country’s already stretched cyber security talent pool.

Noble said the cyber spy agency had received “9000 applications for jobs” in 2021, and that there were currently 700 people in the “pipeline”.

“That is, they’ve passed the selection process, are deemed to have skills that we can utilise in ASD and are waiting to onboard and join our organisation,” she said.

“So, it is not ASD that seems to have an issue, in the way that other experts have so described, in attracting people with the right skills to join our organisation.”

Noble also said that while ASD would need cyber security specialists, not all of the 1900 jobs being created would be in that field.

“We’ll need... data scientists, engineers, linguists, analytics, ICT people, but also policy people, HR people, psychologists, security, compliance, lawyers and people expert in comms,” she said.

“We need a vast array of different skills that will make up that 1900 to deliver REDSPICE.”

Of the staff to join ASD over the decade, Noble said that the bulk would arrive between 2022-23 and 2023-24.

Around 400 staff will join next financial year, followed by 600 in 2023-24, 500 in 2024-25 and 200 in 2025-26. The remaining 165 staff will come to ASD between 2026-27 and 2028-29.

With most staff to join over the next two years, ASD expects to triple its offensive cyber security capabilities in that time.

“Given that offensive cyber... is very reliant on the number of people that we have, what I expect is that by 2026-27 we probably will have reached the tripling,” Noble said.