Senior Governance, Risk & Compliance (GRC) Consultant

Must have

• At least eight years of experience in Governance, Risk & Compliance, cybersecurity assurance, internal audit, technology risk, or risk consulting
• Proven experience delivering client-facing cybersecurity risk, compliance, and maturity assessments
• Ability to independently conduct stakeholder interviews, gather and evaluate evidence, assess controls, and document findings
• Experience preparing detailed assessment reports, executive risk summaries, and prioritised remediation recommendations
• Strong understanding of cybersecurity governance, enterprise risk management, and compliance principles
• Experience collaborating with technical engineers, cybersecurity specialists, business stakeholders, and senior leadership
• Ability to manage multiple assessment activities while maintaining high standards of accuracy and professionalism
• Strong working knowledge of ISO/IEC 27001, including ISMS requirements, risk assessment, control evaluation, and implementation maturity
• Demonstrated experience assessing organisations against the ASD Essential Eight maturity model
• Strong understanding of NIST Cybersecurity Framework 2.0 and its application to risk management and organisational maturity
• Experience conducting control gap analyses, cybersecurity maturity assessments, and compliance readiness reviews
• Understanding of risk registers, inherent and residual risk, control effectiveness, and risk treatment strategies
• Knowledge of cybersecurity governance, incident management, third-party risk, business continuity, and disaster recovery
• Experience in AI governance, data governance, or related risk and compliance disciplines
• Working knowledge of ISO/IEC 42001 or other recognised AI governance and risk management frameworks
• Understanding of risks associated with organisational AI adoption, including privacy, security, accountability, transparency, and governance
• Knowledge of data classification, data protection controls, information lifecycle management, and privacy principles
• Ability to assess governance practices and recommend practical improvements
• Experience developing or applying structured audit and assurance methodologies
• Strong understanding of evidence collection, sampling, control testing, and audit working paper standards
• Ability to distinguish between control design, implementation, and operating effectiveness
• Experience documenting objective findings that are traceable to supporting evidence
• Understanding of assessment independence, quality assurance, and professional ethics
• Ability to produce defensible assessment conclusions for management and external stakeholders
• Exceptional written English and the ability to produce polished reports for senior executives and Boards
• Ability to translate complex technical and compliance matters into clear business risks and actionable recommendations
• Strong presentation, workshop facilitation, and stakeholder engagement skills
• Experience preparing executive summaries, risk dashboards, maturity assessments, and remediation roadmaps
• Confidence communicating difficult findings constructively and professionally
• Strong analytical thinking, attention to detail, and structured problem-solving abilities
• Sound professional judgement and the ability to reach objective, evidence-based conclusions
• Strong integrity, independence, and willingness to challenge unsupported claims
• A practical consulting mindset focused on customer objectives and meaningful business outcomes
• Commercial awareness and the ability to balance security, risk, regulatory obligations, and operational realities
• Strong collaboration skills while maintaining accountability for independent assurance conclusions
• Commitment to keeping up to date with evolving cybersecurity frameworks, regulations, emerging risks, and AI governance requirements
• Ownership of assessment quality, completeness, and delivery

Nice to have

• Experience working with Australian organisations, particularly in regulated sectors such as financial services, healthcare, government, or critical infrastructure, is advantageous
• Familiarity with APRA CPS 234, APRA CPS 230, the Security of Critical Infrastructure Act, the Australian Privacy Act 1988, and Australian Privacy Principles is desirable
• Knowledge of SOC 2, ISO/IEC 27701, ISO 22301, and other relevant assurance frameworks is beneficial
• Understanding of the NIST AI Risk Management Framework is advantageous
• Experience with GRC platforms, risk registers, compliance management systems, or evidence management tools is beneficial
• Experience providing ongoing GRC advisory services, virtual CISO support, or continuous compliance assurance is highly regarded
• Familiarity with Microsoft Purview, Microsoft Defender, Microsoft Entra ID, and Azure governance is beneficial
• ISO/IEC 27001 Lead Auditor
• ISO/IEC 27001 Lead Implementer
• Certified Information Systems Auditor (CISA)
• Certified Information Security Manager (CISM)
• Certified in Risk and Information Systems Control (CRISC)
• IAPP Artificial Intelligence Governance Professional (AIGP)
• ISACA Advanced in AI Audit (AAIA)
• ISO/IEC 42001 Lead Auditor or Lead Implementer
• Additional qualifications in risk management, privacy, cybersecurity governance, or relevant regulatory frameworks will be highly regarded

Technologies

• Azure
• CISM
• Cybersecurity
• Microsoft Entra ID
• NIST
• Microsoft Purview
• Responsible AI
• SOC 2

Highlights

Salary is paid in Australian Dollars. Medical insurance is provided from day one for you and your spouse (or parents if unmarried). There is a home office setup allowance, internet allowance, gym and wellness allowance, and reimbursement for industry certifications. Flexible work arrangements are available (home or office). The company uses AI tools to assist in the hiring process, but final decisions are made by humans.