Are you an experienced Cyber Governance, Risk & Compliance professional ready to lead a transformational security program?
We are seeking a Cyber Governance Risk & Compliance (GRC) Lead to drive our ISO/IEC ***** certification program and establish a best-practice Information Security Management System (ISMS).
This influential role offers the opportunity to shape cyber governance across the business and play a critical role in strengthening our overall security posture.
Why Join Us?
Lead a high-profile ISO ***** certification program
Shape cyber governance across a national organisation
Partner with executive leaders and key business stakeholders
Drive continuous improvement in cyber risk, compliance and assurance
Join a collaborative and supportive technology team
Work on strategic initiatives that directly influence organisational resilience
The Prospect
Reporting to the General Manager - Infrastructure & Security, you will be responsible for leading the implementation, operation and continual improvement of the organisation's Information Security Management System (ISMS).
You will work closely with stakeholders across Technology, Quality and broader business functions to ensure security controls are effectively implemented, monitored and aligned to organisational, regulatory and contractual requirements.
Key Responsibilities
Lead the end-to-end ISO/IEC ***** certification program
Coordinate gap assessments, risk assessments and Statement of Applicability development
Manage certification readiness activities, internal audits and external certification audits
Maintain certification roadmaps, evidence repositories and readiness reporting
Drive accountability across information asset owners, risk owners and control owners
Establish, maintain and continuously improve the Information Security Management System
Develop and review security policies, standards and procedures
Ensure alignment with ISO *****, privacy obligations and contractual requirements




Maintain the cyber risk register and oversee risk treatment activities
Facilitate cyber risk assessments across systems, projects and business processes
Third-Party Risk & Assurance
Manage third-party and supply chain cyber risk programs
Conduct cyber security due diligence and ongoing vendor assurance activities
Coordinate responses to customer, auditor and insurer security assessments
Monitor remediation activities and control effectiveness across suppliers
Develop cyber maturity metrics and security performance reporting
Report on security risks, audit outcomes, control effectiveness and certification readiness
Drive corrective actions, audit remediation and continuous improvement initiatives
Present meaningful insights and recommendations to governance forums and senior leadership
About You
To be successful in this role, you will bring:
Bachelor's degree in Information Security, Risk Management or a related discipline
Minimum 5 years' experience in Cyber Security Governance, Risk & Compliance or Information Security Management
Demonstrated experience leading or supporting ISO/IEC ***** certification programs
Hands-on experience establishing and maintaining an ISMS
Strong understanding of cyber risk management frameworks and methodologies
Experience maintaining risk registers and coordinating risk treatment plans
Excellent stakeholder engagement, communication and influencing skills
ISO/IEC ***** Lead Implementer and/or Lead Auditor certification
CISSP, CRISC, CISA or similar industry-recognised certifications
Experience with NIST Cyber Security Framework, Essential Eight and related standards
Knowledge of privacy, data governance and third-party risk management practices
What Success Looks Like
You will successfully deliver ISO ***** certification, establish a sustainable governance framework, improve cyber risk visibility across the organisation and strengthen assurance capabilities through effective governance, reporting and stakeholder engagement.

📌 Cyber Governance Risk & Compliance Lead (Melbourne)
🏢 City Facilities Management
📍 Melbourne