Job Description

Our Information Security Management System is documented and operating, and we’re completing ISO 27001 certification in the first half of 2027. You’ll support the programme through certification, then own the ongoing assurance cycle, including annual surveillance audits and three-yearly recertification.

This is our first dedicated information security hire. You’ll own the ISMS and coordinate its certification and ongoing assurance, working with executives, system owners, Engineering, IT, our Principal Architect and an external Data Protection Officer.

You’ll set direction and coordinate the work, while staying close to the detail: maintaining the risk and compliance framework, organising assurance activities and helping teams understand their responsibilities.

Own the ISMS and certification programme

- Maintain the ISMS scope, Statement of Applicability, policies and supporting evidence.
- Support the Stage 1 and Stage 2 ISO 27001 audits; coordinate internal and external audits, findings and corrective actions.
- Lead management reviews and report ISMS performance to the ISMS Governance Council.

Manage risk and assurance

- Own the risk method, register and treatment tracking, and facilitate assessments with risk owners.
- Coordinate recurring assurance, including access reviews, control testing, evidence collection and penetration tests.




- Monitor control performance and communicate key exposures, findings and remediation progress.

Oversee compliance, systems and third parties

- Coordinate security and privacy assessments for business systems; maintain the systems inventory.
- Manage vendor and sub-processor security assessments, including onboarding and periodic reviews.
- Support ISO 27001, PCI DSS and privacy compliance, working with the Data Protection Officer on specialist advice.
- Track emerging obligations, including the EU Artificial Intelligence Act, and drive improvements to controls and processes.

Coordinate incidents, awareness and customer assurance

- Maintain the incident response plan, coordinate incidents and track follow-up actions.
- Run security awareness and training, and respond to customer questionnaires and due diligence requests.
- Coordinate security projects across teams to keep actions on track.

How you’ll work with the business

Our Principal Architect leads security architecture and technical control design. IT owns endpoint, identity and corporate systems controls; Engineering owns platform and software development lifecycle controls. Our external Data Protection Officer provides specialist privacy advice.

You’ll make sure controls are in place, owned by the right people, working effectively and supported by evidence.

📌 Senior GRC Analyst (Sydney)
🏢 Luxury Escapes
📍 Sydney