GRC Analyst - AI & OT

About the role

Kmart is looking for a GRC Analyst to join its Cyber Governance, Risk and Compliance team. You will help strengthen how the Kmart Group manages technology risk across information technology, operational technology and artificial intelligence, supporting the safe adoption of emerging technology across stores, supply chain, distribution centres and corporate teams.

Key responsibilities

• Assess technology risks across IT, OT and AI systems, use cases, models, agents and third-party solutions.
• Maintain risk registers, treatment plans and key risk indicators, escalating issues outside approved risk appetite.
• Support internal and external audits, IT general controls testing and regulatory or compliance assessments.
• Review and maintain cyber and AI policies, standards, control evidence and the AI system inventory.
• Design and run AI-enabled GRC workflows for evidence collection, continuous control monitoring, risk assessments and audit preparation.
• Partner with Technology, Cyber Security, Data and AI, Operations, Risk, Audit, Privacy, Legal, Procurement and external providers.
• Deliver clear, data-driven risk reporting, dashboards and practical guidance for technical and non-technical stakeholders.

Required profile

• Around 5-7 years' experience in technology risk, cyber security, GRC, IT audit or a related discipline.
• Recent hands-on experience in AI governance and/or OT governance, with a practical understanding of the other area.
• Experience conducting risk assessments, control testing and supporting internal or external audits.
• Ability to turn complex risk and compliance requirements into practical actions and build trusted stakeholder relationships.
• Working understanding of AI tools, generative AI or agents and how they can improve GRC activities.

Required skills

• Strong working knowledge of the NIST Cybersecurity Framework 2.0.
• Desirable: exposure to NIST AI RMF, ISO/IEC 42001, ISO/IEC 27001, IEC 62443, Essential Eight or CPS 230.
• Advantageous: third-party risk platforms such as UpGuard, and certifications such as AIGP, AICP, ISACA, CRISC, CGRC or CISM.
• Tech employees must be enrolled in the MySkills Program and complete the self-assessment, attaching it with their application.

What we offer

• Flexible hybrid working, with 60% of the week in the National Office.
• Online micro-credentialing, certification support and career opportunities across the Wesfarmers Group.
• Inclusive leave, free onsite parking, a bonus program and a team member discount card.
• Brighter Benefits, a OnePass membership and share purchase option.