Senior Governance, Risk & Compliance (GRC) Consultant

About the role

This role is a senior consultant delivering cybersecurity risk, compliance and maturity assessments, along with ongoing GRC advisory and assurance services to commercial and regulated customers. It covers ISO/IEC 27001, the ASD Essential Eight, NIST Cybersecurity Framework 2.0 and AI governance (ISO/IEC 42001), and includes reporting to senior management and Boards.

Key responsibilities

• Plan and deliver cybersecurity readiness, gap and maturity assessments, including control gap analyses, compliance readiness reviews and AI governance assessments
• Evaluate controls, interview stakeholders, review policies and evidence, and produce defensible, evidence-based findings
• Translate technical findings into business risks and prepare assessment reports, executive summaries, risk heatmaps and remediation roadmaps
• Advise customers on risk treatment, remediation priorities and governance improvements
• Develop and maintain assessment methodologies, templates, control testing procedures and reporting formats, and apply quality assurance and peer review
• Work with technical teams to validate findings and turn control gaps into prioritised remediation recommendations
• Support ongoing governance and assurance, including periodic control reviews, risk register reviews and recurring governance reports
• Assess regulated Australian organisations against APRA CPS 234, CPS 230, the Security of Critical Infrastructure Act and the Australian Privacy Act 1988
• Take part in customer discovery, workshops and stakeholder interviews, and contribute to assessment scopes and proposals

Required profile

• At least eight years of experience in GRC, cybersecurity assurance, internal audit, technology risk or risk consulting
• Proven client-facing experience delivering cybersecurity risk, compliance and maturity assessments
• Ability to run stakeholder interviews, gather evidence, assess controls and write detailed reports and executive summaries
• Experience with Australian regulated sectors (financial services, healthcare, government, critical infrastructure) is advantageous
• Preferred certifications: ISO/IEC 27001 Lead Auditor/Implementer, CISA, CISM, CRISC, AIGP, AAIA, ISO/IEC 42001 Lead Auditor/Implementer

Required skills

• ISO/IEC 27001, ASD Essential Eight, NIST Cybersecurity Framework 2.0, ISO/IEC 42001
• APRA CPS 234, CPS 230, Australian Privacy Principles, SOC 2, ISO/IEC 27701, ISO 22301
• NIST AI Risk Management Framework
• GRC platforms, risk registers, compliance management systems and evidence management tools; Microsoft Purview, Defender, Entra ID and Azure governance are beneficial
• Excellent written English and strong communication with executives and Boards

What we offer

• Paid in Australian dollars
• Medical insurance from day one for you and your spouse (or parents if unmarried)
• Home office setup and internet allowances, gym and wellness allowance
• Team events, rewards and recognition, and Christmas and year-end parties
• Diji Assist mental health and counselling support
• Certification reimbursement and flexible work, home or office