Our Information Security Management System is documented and operating, and we're completing ISO ***** certification in the first half of ****.
You'll support the programme through certification, then own the ongoing assurance cycle, including annual surveillance audits and three‐yearly recertification.Own the ISMS and certification programmeMaintain the ISMS scope, Statement of Applicability, policies and supporting evidence.Support the Stage 1 and Stage 2 ISO ***** audits; coordinate internal and external audits, findings and corrective actions.Lead management reviews and report ISMS performance to the ISMS Governance Council.Manage risk and assuranceOwn the risk method, register and treatment tracking, and facilitate assessments with risk owners.Coordinate recurring assurance, including access reviews, control testing, evidence collection and penetration tests.Monitor control performance and communicate key exposures, findings and remediation progress.Oversee compliance, systems and third partiesOversee compliance, systems and third partiesCoordinate security and privacy assessments for business systems; maintain the systems inventory.Manage vendor and sub‐processor security assessments, including onboarding and periodic reviews.Support ISO *****, PCI DSS and privacy compliance, working with the Data Protection Officer on specialist advice.Track emerging obligations, including the EU Artificial Intelligence Act, and drive improvements to controls and processes.Coordinate incidents, awareness and customer assuranceMaintain the incident response plan, coordinate incidents and track follow‐up actions.Run security awareness and training, and respond to customer questionnaires and due diligence requests.Coordinate security projects across teams to keep actions on track.How you'll work with the businessOur Principal Architect leads security architecture and technical control design.
IT owns endpoint, identity and corporate systems controls; Engineering owns platform and software development lifecycle controls.




Our external Data Protection Officer provides specialist privacy advice.You'll make sure controls are in place, owned by the right people, working effectively and supported by evidence.EssentialExperience running a management system or assurance programme, including evidence and auditor engagement.Practical information security risk management skills and the ability to build clear ownership across teams.Working knowledge of PCI DSS and GDPR or comparable privacy obligations.Experience with third‐party security risk and customer assurance requests.Strong planning, stakeholder management and communication skills, with sound judgement on proportionate controls.DesirableCISM, CISSP, ISO ***** Lead Implementer or Lead Auditor certification.Experience in e‐commerce, travel, payments or another high‐volume consumer environment.Familiarity with AWS, cloud security, SOC 2, AI governance or ISO *****.Working knowledge of security tools and reports, such as EDR, vulnerability management, firewalls, SIEM, Microsoft Entra ID or SaaS access management.Experience working across jurisdictions and distributed teams.What's in it for you?
We consider our people one of our most key assets, and we want our team to love their working lives!
When you work for Luxury Escapes, you can look forward to:Excellent Remuneration package20% discount on Luxury HolidaysBreakfast and lunch are provided 5‐days a weekHealth and Well‐being programsAnnual Hackathons!
1/2 day birthday bonus leaveA super collaborative team that enjoys creating great platformsWe embrace diversity in our people and make hiring decisions based on your experiences and skills.We do not discriminate based on gender identity, religion, race, national origin, sexual orientation, age, marital status, or disability status.You'll find a collaborative, inclusive, and respectful workplace here at Luxury Escapes, and we are proud to celebrate who you are.Please let us know if you require any reasonable adjustments during the interview.As a **** Circle Back Initiative employer, we're committed to responding to every applicant.
#J-*****-Ljbffr

📌 Senior Grc Analyst (Sydney)
🏢 Luxuryescapes
📍 Sydney