Senior Cyber GRC Analyst

About the role

The Senior Cyber GRC Analyst is a key role within REA's Cyber Security GRC team, strengthening cyber resilience by leading the identification, assessment and treatment of technology and information security risks. The role ensures products and platforms comply with security, privacy and regulatory requirements and supports risk-based decisions. It is a permanent position based in Melbourne.

Key responsibilities

• Design, implement and continuously improve cyber GRC frameworks, policies, standards and processes
• Work with REA Security teams to prioritise cyber security controls according to the organisation's risk profile
• Coordinate and oversee control assurance activities such as control testing, audits and attestations, tracking remediation through closure and automating where possible
• Prepare external compliance obligations and audits, and give specialist advice and coaching to technology and product teams on secure-by-design and risk-based thinking
• Monitor changes in cyber, privacy and technology standards, contracts and regulations and turn them into practical guidance
• Prepare and present risk and compliance reports to technology leadership, risk committees and the board
• Support third-party and supplier security assessments, including due diligence and contract review
• Contribute to incident preparedness (playbooks, table-top exercises) and post-incident reviews
• Maintain accurate risk, control and issue registers and drive security culture and automation initiatives

Required profile

• Significant experience in cyber security governance, risk and compliance, technology risk or related fields, ideally in digital or technology-led organisations
• Experience working with product and engineering teams to embed security and risk management
• Solid understanding of modern cloud and product engineering environments (e.g. AWS, CI/CD, microservices)
• Experience coordinating or supporting security audits, certifications or regulatory reviews (e.g. ISO 27001, SOC 2, PCI-DSS)
• Tertiary qualification in Information Security, IT, Risk or a related discipline, or equivalent practical experience

Required skills

• GRC and security tooling such as risk registers, control libraries, workflow tools and vulnerability/issue management platforms
• Using data to produce clear risk insights

What we offer

• A hybrid and flexible working approach
• Flexible leave options, including birthday leave and additional leave
• Parental leave for primary and secondary carers
• Volunteering leave, community grants, matched payroll giving and a community café that donates 100% of its revenue to charity
• Hackdays