IT Security & Compliance Analyst (Internal Role)

About the role

A newly created IT Security & GRC Analyst position within an established professional services firm employing around 300 people across Australian offices. The role strengthens and matures the firm's cybersecurity GRC capabilities and sits in the Sydney CBD office with flexible hybrid working.

Key responsibilities

• Governance: develop and maintain the Information Security governance framework, including policies, standards and procedures.
• Compliance: run compliance assessments and gap analysis against statutory and regulatory requirements, support compliance on new technology initiatives and deliver security awareness training.
• Risk management: identify and assess information security risks, monitor remediation and address findings from security audits and penetration testing.
• Reporting and assurance: produce management reports on cybersecurity KPIs and KRIs, manage audits and third-party questionnaires and build a centralised response library.
• Security advisory: give guidance on applications, infrastructure, patching, IAM and technology projects.
• Operational security: monitor and respond to alerts and incidents escalated by the MSSP, and support BCP/DR plans and testing.

Required profile

• 4+ years of experience in IT Security GRC.
• Experience developing and maintaining cybersecurity policies, procedures and governance frameworks.
• Experience with cybersecurity reporting (KPIs, KRIs) and practical experience with security controls, audit evidence and remediation tracking.
• Experience improving or automating GRC processes.
• Desired: experience managing third-party security assurance and questionnaire responses, and knowledge of APRA CPS 230 and CPS 234.
• Australian citizenship or permanent residency is required.

Required skills

• Familiarity with ISO 27001 and NIST frameworks.
• Strong written and verbal communication, stakeholder engagement and attention to detail.

What we offer

• Salary of $110,000-$120,000 plus superannuation, depending on experience.
• Hybrid working from the Sydney CBD office.
• Direct engagement with senior stakeholders and a small, supportive team.