THE COMPANY This established and well-regarded Professional Services firm employs ~300 employees across multiple Australian offices. With a close-knit culture and a collaborative working environment, this is an organisation where you'll have the chance to build relationships across the business and make a genuine impact. What's on offer?
- Newly created position with the opportunity to mature and improve the firm's cybersecurity GRC function.
- Take ownership of security governance, compliance and reporting initiatives.
- Work closely with an experienced cybersecurity leader who'll provide guidance while giving you the autonomy to deliver.
- Build your presence across the organisation through direct engagement with senior stakeholders.
- Join a small, supportive team where you'll have visibility, ownership and the opportunity to make a tangible impact.
- Sydney CBD office location.
- Flexible hybrid working.
- $110,000-$120,000 + super, depending on experience. THE ROLE & RESPONSIBILITIES This newly created IT Security & GRC Analyst position will play an important role in strengthening and maturing the firm's cybersecurity GRC capabilities. You'll become a key point of contact for security governance and compliance, taking ownership of policies, controls, risk assessments, reporting and stakeholder engagement. Working closely with an experienced cybersecurity leader, you'll have the autonomy to drive improvements, build relationships across the business and help ensure cybersecurity remains front of mind. Responsibilities
- Governance: Develop and maintain the firm's Information Security governance framework, including cybersecurity policies, standards and procedures.
- Compliance: Conduct compliance assessments and gap analysis against relevant statutory and regulatory requirements.



Support security compliance across new technology initiatives and deliver security awareness training.
- Risk Management: Identify and assess information security risks, monitor remediation activities and address findings from security audits and penetration testing.
- Reporting & Assurance: Develop regular management reporting covering cybersecurity KPIs, KRIs and initiatives. Manage audit activities and third-party security questionnaires, including developing a centralised response library.
- Security Advisory: Provide security guidance across applications, infrastructure, patching, identity and access management (IAM) and technology projects.
- Operational Security
- monitor and respond to security alerts and incidents escalated by the MSSP.
- Support BCP/DR plans/testing; while monitoring emerging threats and industry developments. WHAT DOES SUCCESS LOOK LIKE IN THE FIRST 12 MONTHS?
- Establish and maintain a comprehensive cybersecurity controls library.
- Develop a centralised response library for third-party security questionnaires.
- Establish a consistent cybersecurity reporting framework and management reporting cadence.
- Strengthen security controls, improve the firm's overall security posture and contribute to reducing cybersecurity incidents.
- Build strong working relationships across IT, Operations and senior management. REQUIRED EXPERIENCE, KNOWLEDGE,



PERSONAL QUALITIES Ideal for an IT Security & GRC professional with experience across cybersecurity governance, risk and compliance who enjoys working in a close-knit environment where they can take ownership, build relationships and make a genuine impact. This is a hands-on opportunity to build on an existing cybersecurity GRC foundation and take it to the next level. Required

experience:
- 4+ years' experience is an IT Security governance, risk, and compliance (GRC) focused role.
- Experience developing and maintaining cybersecurity policies, procedures and governance frameworks.
- Experience with cybersecurity reporting, including KPIs, KRIs and management reporting.
- Practical experience with security controls, audit evidence management and remediation tracking.
- Familiarity with security frameworks such as ISO 27001 and NIST.
- Experience improving or automating GRC processes and activities. Desired

experience:
- Experience managing third-party security assurance and responding to security questionnaires.
- Knowledge of APRA CPS 230 and CPS 234 requirements. Personal qualities:
- Strong written and verbal communication skills, with the ability to produce clear, concise reports.
- Confident engaging with stakeholders across different levels of the organisation.
- Strong attention to detail, organisation and problem-solving skills.
- Approachable and personable, with the ability to build relationships and influence positive security outcomes.
- Self-motivated and comfortable working autonomously in a small, team-oriented team.
- Friendly and approachable team player. This is a full-time permanent role in the Sydney CBD (hybrid work) and is offering $110,000
- $120,000 (plus super)
- depending on experience. Australian Citizenship o

📌 IT Security (Sydney)
🏢 Robert Half
📍 Sydney