Ready to take ownership of an ISMS, not just advise from the sidelines?

At Cliffside Cybersecurity, we believe effective cybersecurity should be available to every organisation, not treated as a luxury. We are known for being Brutally Honest. We tell clients what needs attention, explain the business impact clearly and help them fix it. We do not produce generic compliance reports that leave clients with more paperwork and no practical way forward.

We are looking for a Senior Cybersecurity Consultant, GRC and ISMS to take an embedded role within our clients’ teams. You will operate and improve established information security management systems, coordinate audit readiness, manage compliance activities and turn framework requirements into work that control owners can actually complete.

This is a hands‑on delivery role. You will work directly with executives, technology teams, control owners, auditors and certification bodies to keep security and compliance programmes operating effectively.

The Chance

You will join Cliffside at a time when clients increasingly need experienced GRC capability without building a large permanent compliance team.

Your work will span established and emerging security frameworks. The immediate focus will be ISO 27001, SOC 2 and operational GRC delivery. Depending on client requirements, you may also contribute to international assurance programmes and AI governance initiatives.

You will be supported by Cliffside’s wider cybersecurity team, including security architects, technical consultants and specialist assurance partners. You will not be expected to solve every issue alone, but you will be expected to recognise risks early,



engage the right expertise and maintain clear accountability for delivery.

What You Will Do

You will take ownership of client outcomes and keep GRC activities moving from identification through to closure.

- Operate information security management systems: Manage established ISO 27001 ISMS activities, including governance calendars, control operation, evidence collection, continual improvement and recurring compliance obligations.
- Drive audit readiness: Prepare clients for internal, certification and surveillance audits by coordinating evidence, validating control operation, briefing stakeholders and tracking actions through to closure.
- Manage remediation: Assess audit findings and control gaps, determine what genuinely requires action and coordinate practical remediation with accountable control owners.
- Maintain policies and governance records: Draft and update policies, procedures, Statements of Applicability, risk treatment plans, management review inputs and other ISMS documentation.
- Manage security risk: Maintain risk registers, facilitate risk assessments, track treatment actions and present material risks in language executives can use to make decisions.
- Support supplier assurance: Triage suppliers,



conduct proportionate third‑party security assessments and work with procurement, privacy, legal and technology stakeholders to resolve identified risks.
- Coordinate recurring controls: Support access reviews, business continuity activities, incident governance, security awareness obligations and other scheduled assurance processes.
- Operate compliance platforms: Manage evidence, controls, tests, integrations and outstanding actions within platforms such as Vanta, Drata or similar GRC and compliance automation tools.
- Work across multiple frameworks: Help clients reuse controls and evidence across ISO 27001, SOC 2 and other applicable security or regulatory frameworks rather than creating disconnected compliance programmes.
- Communicate clearly: Produce concise, evidence‑based reports that explain the issue, business impact, required decision and accountable next action.

About You

We need someone who can enter an established client workplace, understand how it operates and become credible with stakeholders quickly.

- Relevant experience: At least five years of practical cybersecurity governance, risk and compliance experience, including operating or implementing ISO 27001 information security management systems.
- ISO 27001 capability: Strong working knowledge of ISO/IEC 27001:2022, including clauses 4 to 10, Annex A controls, Statements of Applicability, risk treatment and audit requirements.
- Audit readiness: Demonstrated experience preparing organisations for internal, surveillance or certification audits and coordinating the remediation of findings.
- Operational delivery: Experience maintaining polici

📌 Cybersecurity Consultant GRC and ISMS (Australia)
🏢 Cliffside Cybersecurity
📍 Australia