Senior Governance, Risk & Compliance (GRC) Consultant

At least eight years of experience in Governance, Risk & Compliance, cybersecurity assurance, internal audit, technology risk, or risk consulting

Proven experience delivering client-facing cybersecurity risk, compliance, and maturity assessments

Ability to independently conduct stakeholder interviews, gather and evaluate evidence, assess controls, and document findings

Experience preparing detailed assessment reports, executive risk summaries, and prioritised remediation recommendations

Strong understanding of cybersecurity governance, enterprise risk management, and compliance principles

Experience collaborating with technical engineers, cybersecurity specialists, business stakeholders, and senior leadership

Ability to manage multiple assessment activities while maintaining high standards of accuracy and professionalism

Cybersecurity Frameworks & Risk Management

Strong working knowledge of ISO/IEC 27001, including ISMS requirements, risk assessment, control evaluation, and implementation maturity

Demonstrated experience assessing organisations against the ASD Essential Eight maturity model

Strong understanding of NIST Cybersecurity Framework 2.0 and its application to risk management and organisational maturity

Experience conducting control gap analyses, cybersecurity maturity assessments, and compliance readiness reviews

Understanding of risk registers, inherent and residual risk, control effectiveness, and risk treatment strategies

Knowledge of cybersecurity governance, incident management, third-party risk, business continuity, and disaster recovery

AI Governance & Data Protection

Experience in AI governance, data governance, or related risk and compliance disciplines

Working knowledge of ISO/IEC 42001 or other recognised AI governance and risk management frameworks

Understanding of risks associated with organisational AI adoption, including privacy, security, accountability, transparency, and governance

Knowledge of data classification, data protection controls, information lifecycle management, and privacy principles

Ability to assess governance practices and recommend practical improvements

Audit, Assurance & Evidence Management

Experience developing or applying structured audit and assurance methodologies

Strong understanding of evidence collection, sampling, control testing, and audit working paper standards

Ability to distinguish between control design, implementation, and operating effectiveness

Experience documenting objective findings that are traceable to supporting evidence

Understanding of assessment independence, quality assurance, and professional ethics

Ability to produce defensible assessment conclusions for management and external stakeholders

Regulatory & Industry Knowledge

Experience working with Australian organisations, particularly in regulated sectors such as financial services, healthcare, government, or critical infrastructure, is advantageous

Familiarity with APRA CPS 234, APRA CPS 230, the Security of Critical Infrastructure Act, the Australian Privacy Act 1988, and Australian Privacy Principles is desirable

Knowledge of SOC 2, ISO/IEC 27701, ISO 22301, and other relevant assurance frameworks is beneficial

Understanding of the NIST AI Risk Management Framework is advantageous

Experience with GRC platforms, risk registers, compliance management systems, or evidence management tools is beneficial

Experience providing ongoing GRC advisory services, virtual CISO support, or continuous compliance assurance is highly regarded

Familiarity with Microsoft Purview, Microsoft Defender, Microsoft Entra ID, and Azure governance is beneficial

Reporting, Communication & Consulting

Exceptional written English and the ability to produce polished reports for senior executives and Boards

Ability to translate complex technical and compliance matters into clear business risks and actionable recommendations

Strong presentation, workshop facilitation, and stakeholder engagement skills

Experience preparing executive summaries, risk dashboards, maturity assessments, and remediation roadmaps

Confidence communicating difficult findings constructively and professionally

Strong analytical thinking, attention to detail, and structured problem-solving abilities

Professional Attributes

Sound professional judgement and the ability to reach objective, evidence-based conclusions

Strong integrity, independence, and willingness to challenge unsupported claims

A practical consulting mindset focused on customer objectives and meaningful business outcomes

Commercial awareness and the ability to balance security, risk, regulatory obligations, and operational realities

Strong collaboration skills while maintaining accountability for independent assurance conclusions

Commitment to keeping up to date with evolving cybersecurity frameworks, regulations, emerging risks, and AI governance requirements

Ownership of assessment quality, completeness, and delivery

Preferred Certifications

Candidates should ideally hold one or more of the following certifications or demonstrate equivalent professional knowledge and experience:

ISO/IEC 27001 Lead Auditor

ISO/IEC 27001 Lead Implementer

Certified Information Systems Auditor (CISA)

Certified Information Security Manager (CISM)

Certified in Risk and Information Systems Control (CRISC)

IAPP Artificial Intelligence Governance Professional (AIGP)

ISACA Advanced in AI Audit (AAIA)

ISO/IEC 42001 Lead Auditor or Lead Implementer

Additional qualifications in risk management, privacy, cybersecurity governance, or relevant regulatory frameworks will be highly regarded.

Responsibilities

Cybersecurity Risk & Compliance Assessments

Plan, coordinate, and deliver cybersecurity readiness, gap, and maturity assessments for commercial and regulated customers

Assess organisations against recognised frameworks, including ISO/IEC 27001, ASD Essential Eight, NIST Cybersecurity Framework 2.0, and ISO/IEC 42001

Evaluate the design, implementation, and operating effectiveness of security, governance, and risk management controls

Conduct stakeholder interviews, review policies and procedures, and examine technical evidence

Assess risk management, incident response, business continuity, access management, and third-party risk processes

Identify control gaps, governance weaknesses, compliance risks, and improvement opportunities

Ensure findings are accurate, traceable, evidence-based, and defensible

Risk-Based Reporting & Executive Advisory

Translate technical findings and control deficiencies into clearly articulated business risks and organisational impacts

Prepare comprehensive assessment reports for senior management, executive leadership teams, and Boards

Develop executive summaries, risk heatmaps, maturity assessments, control gap analyses, and prioritised recommendations

Explain cybersecurity risks in the context of business operations, regulatory obligations, financial exposure, and organisational resilience

Present findings and recommendations to customer stakeholders, including senior executives and Board representatives

Advise customers on risk treatment options, remediation priorities, and governance improvements

Assessment Methodology & Quality Assurance

Contribute to the development and continuous improvement of managed assurance assessment methodologies

Develop and maintain standardised assessment templates, control testing procedures, evidence requirements, and reporting formats

Establish consistent approaches to risk scoring, maturity assessment, gap analysis, and remediation prioritisation

Maintain documented assessment criteria and evidence standards to support transparency and repeatability

Apply quality assurance, peer review, and independent assessment principles

Identify and manage potential conflicts of interest between assurance activities and technical remediation services

Maintain complete assessment records, supporting evidence, and working