The role A major Australian financial services organisation is looking for someone to own the day to day rhythm of its cyber risk and governance cycle. This is a hands on, delivery focused role with three clear outcomes: a quarterly risk register cycle that closes on time and to a good standard, an annual group cyber reporting submission delivered complete, and an information security policy taken through to approval.

Risk and control owners sit across Cyber, IT and technology shared services. You will be the person who brings it all together, keeps the cycle moving, and lifts the quality of what goes into the register along the way.

What you will deliver

- Run the quarterly renewal of the cyber risk register in RSA Archer: maintain visibility of status across all items, keep owners on track, and make sure the cycle lands on time.
- Improve the quality of risk descriptions, mitigation plans and closure statements. You will review what owners submit, sanity check that it reads clearly and stands on its own, and work with them to strengthen it where it does not. Coaching owners on what good looks like is a real part of the value here.
- Coordinate the annual group cyber reporting cycle. You will work with control owners to gather responses, review them for completeness and consistency, consolidate and validate the set in Excel, and prepare the final file for loading into Archer. Good responses point to the policy, standard or evidence behind them, and you will help owners get there.
- Take a drafted information security policy through review and approval: map the approval path, bring the right stakeholders together, and drive it to sign off.

Scope of the role





This is a coordination and quality role, for clarity:

- You are not re assessing risks or re rating them. Those judgements stay with the risk owners and the cyber team.
- You are not verifying evidence or testing controls. Your review is of how clearly and completely a response is written, not whether the underlying control works.
- You are not designing new frameworks, metrics or reporting. The risks, the assessment questions and the policy content already exist.
- Deep technical specialisation is not required. You need enough cyber fluency to read a mitigation plan or a closure statement and tell whether it makes sense, across areas such as identity, monitoring and vulnerability management. You do not need to be an engineer or a tester.

What we are looking for

- Three to five years in cyber, IT risk, GRC support or a CISO office role. Hands-on experience with RSA Archer or a comparable GRC platform or aptitude to pick one up quickly.
- Enough cyber fluency to tell whether a risk description or closure statement is fit for purpose and to help an owner improve theirs. Strong Excel.
- Above all, a persistent and professional coordinator who can bring senior and technical stakeholders along with them and keep momentum without losing the room.
- If you have run coordination in a technical setting and you learn fast, we can build the cyber knowledge on top.

The details

Start as soon as possible. Three months initially, with extension expected. Part time, around two to four days per week (flexible). Sydney based, hybrid. Engaged as a contractor through Barely Viable Consulting (BVC). Apply through LinkedIn or send a short note and your CV to [email protected]

📌 Cyber Risk and Governance Coordinator (3 Month Contract, 2 to 4 Days per Week) (Sydney)
🏢 BVC
📍 Sydney