Cyber GRC Analyst – 12‑Month Contract

About the role

We are seeking a Cyber GRC Analyst to join the cyber governance, risk and compliance team of a national heavy‑goods organisation on a 12‑month contract. The analyst will work closely with business units to embed the existing cyber security policy suite, support security awareness initiatives and assist with audit preparation and remediation.

Key responsibilities

• Guide business units in applying the cyber security policy suite to daily operations.
• Manage policy exception requests and maintain tracking registers.
• Identify gaps between current practices and policy requirements and document them.
• Translate policy obligations into practical controls, processes and artefacts.
• Coordinate and report on security awareness and training programmes across multiple jurisdictions.
• Track mandatory training completion and organise sessions with stakeholders and L&D.
• Support internal and external audits by gathering evidence, coordinating activities and maintaining audit readiness.
• Maintain remediation registers, monitor findings and drive remediation actions.
• Contribute to risk assessments, documentation, tracking and GRC reporting.
• Assist with third‑party and supplier risk assessments and other prioritized GRC projects.

Required profile

• Strong fundamentals in governance, risk, compliance and control frameworks.
• Proven experience supporting cyber security policy adoption across business units.
• Experience delivering or coordinating security awareness and training programmes.
• Hands‑on audit support experience, including evidence collection and findings tracking.
• Excellent stakeholder engagement skills with both IT and non‑IT teams.
• Ability to work independently, manage competing priorities and collaborate within a team.
• Working knowledge of ISO 27001 and/or the Australian Essential Eight framework.
• Relevant tertiary qualification in cyber security, IT, risk or a related discipline is desirable.
• Professional certifications such as CISM, CRISC, CISA are a plus.

Required skills

• ISO 27001
• Essential Eight
• GRC platforms
• Risk register tooling