Senior Governance, Risk & Compliance (GRC) Consultant

-
At least eight years of experience in Governance, Risk & Compliance, cybersecurity assurance, internal audit, technology risk, or risk consulting

-
Proven experience delivering client-facing cybersecurity risk, compliance, and maturity assessments

-
Ability to independently conduct stakeholder interviews, gather and evaluate evidence, assess controls, and document findings

-
Experience preparing detailed assessment reports, executive risk summaries, and prioritised remediation recommendations

-
Strong understanding of cybersecurity governance, enterprise risk management, and compliance principles

-
Experience collaborating with technical engineers, cybersecurity specialists, business stakeholders, and senior leadership

-
Ability to manage multiple assessment activities while maintaining high standards of accuracy and professionalism

Cybersecurity Frameworks & Risk Management

-
Strong working knowledge of ISO/IEC 27001, including ISMS requirements, risk assessment, control evaluation, and implementation maturity

-
Demonstrated experience assessing organisations against the ASD Essential Eight maturity model

-
Strong understanding of NIST Cybersecurity Framework 2.0 and its application to risk management and organisational maturity

-
Experience conducting control gap analyses, cybersecurity maturity assessments, and compliance readiness reviews

-
Understanding of risk registers, inherent and residual risk, control effectiveness, and risk treatment strategies

-
Knowledge of cybersecurity governance, incident management, third-party risk, business continuity, and disaster recovery

AI Governance & Data Protection

-
Experience in AI governance, data governance, or related risk and compliance disciplines

-
Working knowledge of ISO/IEC 42001 or other recognised AI governance and risk management frameworks

-
Understanding of risks associated with organisational AI adoption, including privacy, security, accountability, transparency, and governance

-
Knowledge of data classification, data protection controls, information lifecycle management, and privacy principles

-
Ability to assess governance practices and recommend practical improvements

Audit, Assurance & Evidence Management

-
Experience developing or applying structured audit and assurance methodologies

-
Strong understanding of evidence collection, sampling, control testing, and audit working paper standards

-
Ability to distinguish between control design, implementation, and operating effectiveness

-
Experience documenting objective findings that are traceable to supporting evidence

-
Understanding of assessment independence, quality assurance, and professional ethics

-
Ability to produce defensible assessment conclusions for management and external stakeholders

Regulatory & Industry Knowledge

-
Experience working with Australian organisations, particularly in regulated sectors such as financial services, healthcare, government, or critical infrastructure, is advantageous

-
Familiarity with APRA CPS 234, APRA CPS 230, the Security of Critical Infrastructure Act, the Australian Privacy Act 1988, and Australian Privacy Principles is desirable

-
Knowledge of SOC 2, ISO/IEC 27701, ISO 22301, and other relevant assurance frameworks is beneficial

-
Understanding of the NIST AI Risk Management Framework is advantageous

-
Experience with GRC platforms, risk registers, compliance management systems, or evidence management tools is beneficial

-
Experience providing ongoing GRC advisory services, virtual CISO support, or continuous compliance assurance is highly regarded

-
Familiarity with Microsoft Purview, Microsoft Defender, Microsoft Entra ID, and Azure governance is beneficial

Reporting, Communication & Consulting

-
Exceptional written English and the ability to produce polished reports for senior executives and Boards

-
Ability to translate complex technical and compliance matters into clear business risks and actionable recommendations

-
Strong presentation, workshop facilitation, and stakeholder engagement skills

-
Experience preparing executive summaries, risk dashboards, maturity assessments, and remediation roadmaps

-
Confidence communicating difficult findings constructively and professionally

-
Strong analytical thinking, attention to detail, and structured problem-solving abilities

Professional Attributes

-
Sound professional judgement and the ability to reach objective, evidence-based conclusions

-
Strong integrity, independence, and willingness to challenge unsupported claims

-
A practical consulting mindset focused on customer objectives and meaningful business outcomes

-
Commercial awareness and the ability to balance security, risk, regulatory obligations, and operational realities

-
Strong collaboration skills while maintaining accountability for independent assurance conclusions

-
Commitment to keeping up to date with evolving cybersecurity frameworks, regulations, emerging risks, and AI governance requirements

-
Ownership of assessment quality, completeness, and delivery

Preferred Certifications

Candidates should ideally hold one or more of the following certifications or demonstrate equivalent professional knowledge and experience:

-
ISO/IEC 27001 Lead Auditor

-
ISO/IEC 27001 Lead Implementer

-
Certified Information Systems Auditor (CISA)

-
Certified Information Security Manager (CISM)

-
Certified in Risk and Information Systems Control (CRISC)

-
IAPP Artificial Intelligence Governance Professional (AIGP)

-
ISACA Advanced in AI Audit (AAIA)

-
ISO/IEC 42001 Lead Auditor or Lead Implementer

Additional qualifications in risk management, privacy, cybersecurity governance, or relevant regulatory frameworks will be highly regarded.

Responsibilities

Cybersecurity Risk & Compliance Assessments

-
Plan, coordinate, and deliver cybersecurity readiness, gap, and maturity assessments for commercial and regulated customers

-
Assess organisations against recognised frameworks, including ISO/IEC 27001, ASD Essential Eight, NIST Cybersecurity Framework 2.0, and ISO/IEC 42001

-
Evaluate the design, implementation, and operating effectiveness of security, governance, and risk management controls

-
Conduct stakeholder interviews, review policies and procedures, and examine technical evidence

-
Assess risk management, incident response, business continuity, access management, and third-party risk processes

-
Identify control gaps, governance weaknesses, compliance risks, and improvement opportunities

-
Ensure findings are accurate, traceable, evidence-based, and defensible

Risk-Based Reporting & Executive Advisory

-
Translate technical findings and control deficiencies into clearly articulated business risks and organisational impacts

-
Prepare comprehensive assessment reports for senior management, executive leadership teams, and Boards

-
Develop executive summaries, risk heatmaps, maturity assessments, control gap analyses, and prioritised recommendations

-
Explain cybersecurity risks in the context of business operations, regulatory obligations, financial exposure, and organisational resilience

-
Present findings and recommendations to customer stakeholders, including senior executives and Board representatives

-
Advise customers on risk treatment options, remediation priorities, and governance improvements

Assessment Methodology & Quality Assurance

-
Contribute to the development and continuous improvement of managed assurance assessment methodologies

-
Develop and maintain standardised assessment templates, control testing procedures, evidence requirements, and reporting formats

-
Establish consistent approaches to risk scoring, maturity assessment, gap analysis, and remediation prioritisation

-
Maintain documented assessment criteria and evidence standards to support transparency and repeatability

-
Apply quality assurance, peer review, and independent assessment principles

-
Identify and manage potential conflicts of interest between assurance activities and technical remediation services

-
Maintain complete assessment records, supporting evidence, and working papers

-
Monitor changes to frameworks, standards, and regulatory requirements and recommend updates to assessment methodologies

Risk Remediation Planning & Technical Collaboration

-
Collaborate with cybersecurity, infrastructure, cloud, and operations teams to validate technical findings and supporting evidence

-
Assess the effectiveness of technical and administrative security controls

-
Translate control deficiencies into practical, prioritised remediation recommendations

-
Develop remediation roadmaps that account for risk severity, business impact, regulatory requirements, implementation complexity, and available resources

-
Help customers determine appropriate risk treatment strategies, including remediation, mitigation, acceptance, and transfer

-
Guide technical teams on governance and compliance requirements associated with remediation

-
Validate remediation evidence and confirm whether identified gaps have been appropriately addressed

-
Maintain appropriate separation between independent assurance and technical implementation responsibilities

Continuous Governance & Assurance

-
Support ongoing governance and assurance services to help customers maintain and improve their compliance posture

-
Conduct periodic reviews of security controls, risk registers, policies, compliance obligations, and remediation progress

-
Help customers maintain cybersecurity governance frameworks, risk management processes, and compliance documentation

-
Monitor changes in organisational risk profiles, emerging threats, regulatory requirements, and control effectiveness

-
Support ongoing risk assessments, control monitoring, and compliance reporting

-
Prepare recurring governance reports, risk dashboards, and management updates

-
Participate in governance meetings, risk committee discussions, and executive reporting

-
Identify opportunities to improve risk ownership, accountability, and governance maturity

-
Promote continuous improvement rather than reliance solely on annual or point-in-time assessments

AI Governance & Data Protection

-
Assess and improve organisational governance arrangements for artificial intelligence and data management

-
Conduct AI governance readiness and maturity assessments aligned with ISO/IEC 42001 and relevant AI risk management principles

-
Evaluate AI governance policies, accountability structures, risk assessment processes, and oversight mechanisms

-
Identify risks associated with AI adoption, including data privacy, security, transparency, bias, third-party dependencies, and inappropriate use

-
Assess controls for responsible AI adoption, including risk classification, human oversight, and monitoring

-
Review data governance practices covering information classification, data handling, retention, access controls, and privacy obligations

-
Develop practical recommendations to strengthen AI and data governance

-
Monitor developments in AI governance standards and regulatory expectations

Regulatory Compliance & Industry Frameworks

-
Assess customer security and governance practices against applicable legislative and regulatory obligations

-
Support compliance readiness and gap assessments for regulated Australian organisations

-
Evaluate requirements associated with APRA CPS 234, APRA CPS 230, the Security of Critical Infrastructure Act, and the Australian Privacy Act 1988 and Australian Privacy Principles

-
Explain how regulatory obligations translate into governance, security, and operational controls

-
Identify regulatory compliance gaps and develop risk-based improvement recommendations

-
Collaborate with customer stakeholders and relevant specialists to support regulatory assurance initiatives

Client Engagement & Consulting Delivery

-
Participate in customer discovery sessions, assessment workshops, and stakeholder interviews

-
Build trusted professional relationships with executives, risk owners, IT leaders, and security teams

-
Manage assigned assessment activities against agreed timelines, quality standards, and deliverables

-
Clearly communicate assessment requirements, evidence requests, findings, and recommendations

-
Exercise sound professional judgement when evaluating incomplete evidence, control effectiveness, and risk exposure

-
Contribute to assessment scopes, delivery plans, and customer proposals as required

-
Support the ongoing improvement of managed assurance service offerings

How we take care of our team

💰 Get paid in Australian Dollars
🏥 Medical insurance from day one for you + spouse (or parents if unmarried)
🩺 Generous OPD coverage from doctor visits to all your medical needs
🏡 Home office setup allowance to build your ideal workspace
🌐 Internet allowance to keep you connected
💪 Gym & wellness allowance to stay fit and balanced
🎉 Work hard, play hard – regular team events & engagement activities
🧠 Diji Assist – Mental health & counseling support when you need it
📚 We invest in you – reimbursement for industry certifications
🗣️ Open-door culture – your ideas and feedback always matter
🌍 Flexible work – home or office, wherever you do your best work
🏆 Rewards & recognition that actually recognize you
🥳 Great christmas & financial year-end parties to unwind with your loved ones