Join our Cyber Strategy & Transformation team as a Deputy Manager, GRC Specialist. This role is pivotal in strengthening our cybersecurity posture by ensuring robust control management and regulatory compliance. You'll play a key part in safeguarding organizational assets through vigilant risk management and strategic security planning.

We focus on enabling organizations to prevent cyberattacks, protect critical assets, and foster resilience. By embedding cyber risk management into strategic development, we empower businesses to confidently seize new opportunities while managing information and technology risks effectively. Learn more about our Cybersecurity offerings.

Manage and validate cybersecurity controls across the organization, ensuring adherence to regulatory and internal requirements. This involves interpreting security controls, validating evidence, and supporting audits in areas like Cryptography, DLP, Endpoint Security, and Network Security.

Work collaboratively with technology and security teams to implement and manage cybersecurity controls. Translate control requirements into actionable technical expectations for implementation teams and establish effective validation approaches to assess control effectiveness and identify any implementation gaps.

Handle cybersecurity due diligence questionnaires from clients, partners, and vendors, coordinating with internal stakeholders to ensure accurate responses and gather supporting evidence. Ensure all communications are technically precise and align with organizational policies. Track questionnaire status, timelines, and outcomes diligently.

Oversee the collection, validation, and documentation of evidence supporting control compliance and audit needs. Analyze control validation results, pinpoint control weaknesses, and escalate critical risks to senior management. Support and manage regulatory and audit activities, including evidence collection, validation, and remediation tracking.

Develop and maintain a deep understanding of regulatory frameworks such as APRA, ASIC, ISO 27001, NIST, CPS 234, CPS 220, and CPS 232. Recommend and implement process improvements for control validation, documentation, and reporting. Foster a strong organizational understanding of cybersecurity controls, risks, and compliance requirements. Stay abreast of evolving threats, regulations, and best practices to ensure continuous compliance and effectiveness.

A Bachelor’s degree in Computer Science, Information Technology, or a related field is required, complemented by 6-8 years of experience in Cybersecurity GRC, cyber control reviews, assessments, or testing, with a strong focus on security controls.

Possess a solid understanding of Cryptography and PKI (TLS, certificates), Data Loss Prevention (DLP), and both endpoint and network security controls. Familiarity with security frameworks such as NIST CSF, CIS, and ISO 27001 is essential, alongside a strong grasp of control frameworks and standards including ISO 27001, NIST, SOX, COBIT, GDPR, APRA, and other regional regulations.

Demonstrate strong analytical and problem-solving abilities, coupled with excellent communication and documentation skills. The capacity to manage multiple priorities and work autonomously is key.

Experience with GRC tools like ServiceNow GRC or IBM OpenPages, exposure to automation or scripting for evidence collection, and familiarity with cloud environments (AWS/Azure) are considered advantageous. Preferred certifications include CISSP, CISA, CRISC, or ISO 27001 Lead Auditor/Implementer.