- At least eight years of experience in Governance, Risk &
- Compliance, cybersecurity assurance, internal audit, technology risk, or risk consulting
- Proven experience delivering client-facing cybersecurity risk, compliance, and maturity assessments
- Ability to independently conduct stakeholder interviews, gather and evaluate evidence, assess controls, and document findings
- Experience preparing detailed assessment reports, executive risk summaries, and prioritised remediation recommendations
- Strong understanding of cybersecurity governance, enterprise risk management, and compliance principles
- Experience collaborating with technical engineers, cybersecurity specialists, business stakeholders, and senior leadership
- Ability to manage multiple assessment activities while maintaining high standards of accuracy and professionalism

Cybersecurity Frameworks &
- Risk Management

- Strong working knowledge of ISO/IEC 27001, including ISMS requirements, risk assessment, control evaluation, and implementation maturity
- Demonstrated experience assessing organisations against the ASD Essential Eight maturity model
- Strong understanding of NIST Cybersecurity Framework 2.0 and its application to risk management and organisational maturity
- Experience conducting control gap analyses, cybersecurity maturity assessments, and compliance readiness reviews
- Understanding of risk registers, inherent and residual risk, control effectiveness, and risk treatment strategies
- Knowledge of cybersecurity governance, incident management, third-party risk, business continuity, and disaster recovery

AI Governance &
- Data Protection

- Experience in AI governance, data governance, or related risk and compliance disciplines
- Working knowledge of ISO/IEC 42001 or other recognised AI governance and risk management frameworks
- Understanding of risks associated with organisational AI adoption, including privacy, security, accountability, transparency, and governance
- Knowledge of data classification, data protection controls, information lifecycle management, and privacy principles
- Ability to assess governance practices and recommend practical improvements

Audit, Assurance &
- Evidence Management

- Experience developing or applying structured audit and assurance methodologies
- Strong understanding of evidence collection, sampling, control testing, and audit working paper standards
- Ability to distinguish between control design, implementation, and operating effectiveness
- Experience documenting objective findings that are traceable to supporting evidence
- Understanding of assessment independence, quality assurance, and professional ethics
- Ability to produce defensible assessment conclusions for management and external stakeholders

Regulatory &
- Industry Knowledge

- Experience working with Australian organisations, particularly in regulated sectors such as financial services, healthcare, government, or critical infrastructure, is advantageous
- Familiarity with APRA CPS 234, APRA CPS 230, the Security of Critical Infrastructure Act, the Australian Privacy Act 1988, and Australian Privacy Principles is desirable
- Knowledge of SOC 2, ISO/IEC 27701, ISO 22301, and other relevant assurance frameworks is beneficial
- Understanding of the NIST AI Risk Management Framework is advantageous
- Experience with GRC platforms, risk registers, compliance management systems, or evidence management tools is beneficial
- Experience providing ongoing GRC advisory services, virtual CISO support, or continuous compliance assurance is highly regarded
- Familiarity with Microsoft Purview, Microsoft Defender, Microsoft Entra ID, and Azure governance is beneficial

Reporting, Communication &
- Consulting

- Exceptional written English and the ability to produce polished reports for senior executives and Boards
- Ability to translate complex technical and compliance matters into clear business risks and actionable recommendations
- Strong presentation, workshop facilitation, and stakeholder engagement skills
- Experience preparing executive summaries, risk dashboards, maturity assessments, and remediation roadmaps
- Confidence communicating difficult findings constructively and professionally
- Strong analytical thinking, attention to detail, and structured problem-solving abilities

Qualified Attributes
- Sound professional judgement and the ability to reach objective, evidence-based conclusions
- Strong integrity, independence, and willingness to challenge unsupported claims
- A practical consulting mindset focused on customer objectives and meaningful business outcomes
- Commercial awareness and the ability to balance security, risk, regulatory obligations, and operational realities




- Strong collaboration skills while maintaining accountability for independent assurance conclusions
- Commitment to keeping up to date with evolving cybersecurity frameworks, regulations, emerging risks, and AI governance requirements
- Ownership of assessment quality, completeness, and delivery

Preferred Certifications Candidates should ideally hold one or more of the following certifications or demonstrate equivalent professional knowledge and experience:

- ISO/IEC 27001 Lead Auditor
- ISO/IEC 27001 Lead Implementer
- Certified Information Systems Auditor (CISA)
- Certified Information Security Manager (CISM)
- Certified in Risk and Information Systems Control (CRISC)
- IAPP Artificial Intelligence Governance Professional (AIGP)
- ISACA Advanced in AI Audit (AAIA)
- ISO/IEC 42001 Lead Auditor or Lead Implementer

Additional qualifications in risk management, privacy, cybersecurity governance, or relevant regulatory frameworks will be highly regarded.

Responsibilities

Cybersecurity Risk &

- Compliance Assessments

- Plan, coordinate, and deliver cybersecurity readiness, gap, and maturity assessments for commercial and regulated customers
- Assess organisations against recognised frameworks, including ISO/IEC 27001, ASD Essential Eight, NIST Cybersecurity Framework 2.0, and ISO/IEC 42001
- Evaluate the design, implementation, and operating effectiveness of security, governance, and risk management controls
- Conduct stakeholder interviews, review policies and procedures, and examine technical evidence
- Assess risk management, incident response, business continuity, access management, and third-party risk processes
- Identify control gaps, governance weaknesses, compliance risks, and improvement opportunities
- Ensure findings are accurate, traceable, evidence-based, and defensible

Risk-Based Reporting &
- Executive Advisory

- Translate technical findings and control deficiencies into clearly articulated business risks and organisational impacts
- Prepare comprehensive assessment reports for senior management, executive leadership teams, and Boards
- Develop executive summaries, risk heatmaps, maturity assessments, control gap analyses, and prioritised recommendations
- Explain cybersecurity risks in the context of business operations, regulatory obligations, financial exposure, and organisational resilience
- Present findings and recommendations to customer stakeholders, including senior executives and Board representatives
- Advise customers on risk treatment options, remediation priorities, and governance improvements

Assessment Methodology &
- Quality Assurance

- Contribute to the development and continuous improvement of managed assurance assessment methodologies
- Develop and maintain standardised assessment templates, control testing procedures, evidence requirements, and reporting formats
- Establish consistent approaches to risk scoring, maturity assessment, gap analysis, and remediation prioritisation
- Maintain documented assessment criteria and evidence standards to support transparency and repeatability
- Apply quality assurance, peer review, and independent assessment principles
- Identify and manage potential conflicts of interest between assurance activities and technical remediation services
- Maintain complete assessment records, supporting evidence, and working papers
- Monitor changes to frameworks, standards, and regulatory requirements and recommend updates to assessment methodologies

Risk Remediation Planning &
- Technical Collaboration

- Collaborate with cybersecurity, infrastructure, cloud, and operations teams to validate technical findings and supporting evidence
- Assess the effectiveness of technical and administrative security controls
- Translate control deficiencies into practical, prioritised remediation recommendations
- Develop remediation roadmaps that account for risk severity, business impact, regulatory requirements, implementation complexity, and available resources
- Help customers determine appropriate risk treatment strategies, including remediation, mitigation, acceptance, and transfer
- Guide technical teams on governance and compliance requirements associated with remediation
- Validate remediation evidence and confirm whether identified gaps have been appropriately addressed




- Maintain appropriate separation between independent assurance and technical implementation responsibilities

Continuous Governance &
- Assurance

- Support ongoing governance and assurance services to help customers maintain and improve their compliance posture
- Conduct periodic reviews of security controls, risk registers, policies, compliance obligations, and remediation progress
- Help customers maintain cybersecurity governance frameworks, risk management processes, and compliance documentation
- Monitor changes in organisational risk profiles, emerging threats, regulatory requirements, and control effectiveness
- Support ongoing risk assessments, control monitoring, and compliance reporting
- Prepare recurring governance reports, risk dashboards, and management updates
- Participate in governance meetings, risk committee discussions, and executive reporting
- Identify opportunities to improve risk ownership, accountability, and governance maturity
- Promote continuous improvement rather than reliance solely on annual or point-in-time assessments

AI Governance &
- Data Protection

- Assess and improve organisational governance arrangements for artificial intelligence and data management
- Conduct AI governance readiness and maturity assessments aligned with ISO/IEC 42001 and relevant AI risk management principles
- Evaluate AI governance policies, accountability structures, risk assessment processes, and oversight mechanisms
- Identify risks associated with AI adoption, including data privacy, security, transparency, bias, third-party dependencies, and inappropriate use
- Assess controls for responsible AI adoption, including risk classification, human oversight, and monitoring
- Review data governance practices covering information classification, data handling, retention, access controls, and privacy obligations
- Develop practical recommendations to strengthen AI and data governance
- Monitor developments in AI governance standards and regulatory expectations

Regulatory Compliance &
- Industry Frameworks

- Assess customer security and governance practices against applicable legislative and regulatory obligations
- Support compliance readiness and gap assessments for regulated Australian organisations
- Evaluate requirements associated with APRA CPS 234, APRA CPS 230, the Security of Critical Infrastructure Act, and the Australian Privacy Act 1988 and Australian Privacy Principles
- Explain how regulatory obligations translate into governance, security, and operational controls
- Identify regulatory compliance gaps and develop risk-based improvement recommendations
- Collaborate with customer stakeholders and relevant specialists to support regulatory assurance initiatives

Client Engagement &
- Consulting Delivery

- Participate in customer discovery sessions, assessment workshops, and stakeholder interviews
- Build trusted professional relationships with executives, risk owners, IT leaders, and security teams
- Manage assigned assessment activities against agreed timelines, quality standards, and deliverables
- Clearly communicate assessment requirements, evidence requests, findings, and recommendations
- Exercise sound professional judgement when evaluating incomplete evidence, control effectiveness, and risk exposure
- Contribute to assessment scopes, delivery plans, and customer proposals as required
- Support the ongoing improvement of managed assurance service offerings

How we take care of our team ?
- Get paid in Australian Dollars

?
- Medical insurance from day one for you + spouse (or parents if unmarried)

?
- Generous OPD coverage from doctor visits to all your medical needs

?
- Home office setup allowance to build your ideal workspace

?
- Internet allowance to keep you connected

?
- Gym & wellness allowance to stay fit and balanced

?
- Work hard, play hard – regular team events & engagement activities

?
- Diji Assist –
- Mental health & counseling support when you need it

?
- We invest in you – reimbursement for industry certifications

?️
- Open-door culture – your ideas and feedback always matter

?
- Flexible work – home or office, wherever you do your best work

?
- Rewards & recognition that actually recognize you

?
- Great christmas & financial year-end parties to unwind with your loved ones

We may use artificial intelligence (AI) tools to support parts of the hiring process, such as reviewing applications, analyzing resumes, or assessing responses and identifying potential inconsistencies or verification signals in application materials based on available information. These tools assist our recruitment team but do not replace human judgment. Final hiring decisions are ultimately made by humans. If you would like more information about how your data is processed, please contact us.

📌 Senior Governance, Risk & Compliance (GRC) Consultant (Kolamba)
🏢 Dijital Team
📍 Kolamba