Senior Governance, Risk & Compliance Consultant

• Plan, coordinate, and deliver cybersecurity readiness, gap, and maturity assessments for commercial and regulated customers
• Assess organisations against ISO/IEC 27001, ASD Essential Eight, NIST Cybersecurity Framework 2.0, and ISO/IEC 42001
• Evaluate the design, implementation, and operating effectiveness of security, governance, and risk management controls
• Conduct stakeholder interviews, review policies and procedures, and examine technical evidence
• Identify control gaps, governance weaknesses, compliance risks, and improvement opportunities
• Prepare assessment reports, executive summaries, risk heatmaps, maturity assessments, control gap analyses, and prioritised recommendations
• Present findings and recommendations to senior executives and Board representatives
• Advise customers on risk treatment options, remediation priorities, and governance improvements
• Develop and maintain assessment templates, control testing procedures, evidence requirements, and reporting formats
• Apply quality assurance, peer review, and independent assessment principles
• Maintain assessment records, supporting evidence, and working papers
• Collaborate with cybersecurity, infrastructure, cloud, and operations teams to validate findings and evidence
• Develop remediation roadmaps and guide technical teams on governance and compliance requirements
• Validate remediation evidence and confirm identified gaps are addressed
• Support ongoing governance and assurance services, periodic control reviews, risk assessments, control monitoring, and compliance reporting
• Prepare recurring governance reports, risk dashboards, and management updates
• Participate in governance meetings, risk committee discussions, and executive reporting
• Conduct AI governance readiness and maturity assessments aligned with ISO/IEC 42001
• Evaluate AI governance policies, accountability structures, risk assessment processes, and oversight mechanisms
• Review data governance practices covering classification, handling, retention, access controls, and privacy obligations
• Assess customer practices against legislative and regulatory obligations, including Australian requirements
• Participate in customer discovery sessions, assessment workshops, and stakeholder interviews
• Manage assigned assessment activities against agreed timelines, quality standards, and deliverables
• Contribute to assessment scopes, delivery plans, customer proposals, and managed assurance service improvements

• At least eight years of experience in Governance, Risk & Compliance, cybersecurity assurance, internal audit, technology risk, or risk consulting
• Proven experience delivering client-facing cybersecurity risk, compliance, and maturity assessments
• Ability to independently conduct stakeholder interviews, gather and evaluate evidence, assess controls, and document findings
• Experience preparing detailed assessment reports, executive risk summaries, and prioritised remediation recommendations
• Strong understanding of cybersecurity governance, enterprise risk management, and compliance principles
• Experience collaborating with technical engineers, cybersecurity specialists, business stakeholders, and senior leadership
• Ability to manage multiple assessment activities while maintaining high standards of accuracy and professionalism
• Strong working knowledge of ISO/IEC 27001, including ISMS requirements, risk assessment, control evaluation, and implementation maturity
• Demonstrated experience assessing organisations against the ASD Essential Eight maturity model
• Strong understanding of NIST Cybersecurity Framework 2.0 and its application to risk management and organisational maturity
• Experience conducting control gap analyses, cybersecurity maturity assessments, and compliance readiness reviews
• Understanding of risk registers, inherent and residual risk, control effectiveness, and risk treatment strategies
• Knowledge of cybersecurity governance, incident management, third-party risk, business continuity, and disaster recovery
• Experience in AI governance, data governance, or related risk and compliance disciplines
• Working knowledge of ISO/IEC 42001 or other recognised AI governance and risk management frameworks
• Understanding of risks associated with organisational AI adoption, including privacy, security, accountability, transparency, and governance
• Knowledge of data classification, data protection controls, information lifecycle management, and privacy principles
• Experience developing or applying structured audit and assurance methodologies
• Strong understanding of evidence collection, sampling, control testing, and audit working paper standards
• Ability to distinguish between control design, implementation, and operating effectiveness
• Experience documenting objective findings traceable to supporting evidence
• Understanding of assessment independence, quality assurance, and professional ethics
• Ability to produce defensible assessment conclusions
• Exceptional written English
• Strong presentation, workshop facilitation, and stakeholder engagement skills
• Strong analytical thinking, attention to detail, and structured problem-solving abilities
• Sound professional judgement and ability to reach objective, evidence-based conclusions
• Strong integrity, independence, and willingness to challenge unsupported claims
• Commercial awareness and ability to balance security, risk, regulatory obligations, and operational realities
• Commitment to keeping up to date with evolving cybersecurity frameworks, regulations, emerging risks, and AI governance requirements
• Ownership of assessment quality, completeness, and delivery
• Experience working with Australian organisations is advantageous
• Familiarity with APRA CPS 234, APRA CPS 230, the Security of Critical Infrastructure Act, the Australian Privacy Act 1988, and Australian Privacy Principles is desirable
• Knowledge of SOC 2, ISO/IEC 27701, ISO 22301, and other relevant assurance frameworks is beneficial
• Understanding of the NIST AI Risk Management Framework is advantageous
• Experience with GRC platforms, risk registers, compliance management systems, or evidence management tools is beneficial
• Experience providing ongoing GRC advisory services, virtual CISO support, or continuous compliance assurance is highly regarded
• Familiarity with Microsoft Purview, Microsoft Defender, Microsoft Entra ID, and Azure governance is beneficial
• Preferred certifications include ISO/IEC 27001 Lead Auditor, ISO/IEC 27001 Lead Implementer, CISA, CISM, CRISC, AIGP, AAIA, and ISO/IEC 42001 Lead Auditor or Lead Implementer; equivalent professional knowledge and experience may be demonstrated

• Get paid in Australian Dollars
• Medical insurance from day one for you + spouse (or parents if unmarried)
• Generous OPD coverage from doctor visits to all your medical needs
• Home office setup allowance
• Internet allowance
• Gym & wellness allowance
• Regular team events and engagement activities
• Diji Assist mental health and counseling support
• Reimbursement for industry certifications
• Open-door culture
• Flexible work – home or office
• Rewards and recognition
• Christmas and financial year-end parties