Cyber GRC Analyst

Location: Sydney, NSW

Employment type: Permanent, full time

Security requirements: Australian citizenship; ability to obtain and maintain an appropriate Australian Government security clearance.

Reports to: APAC Cybersecurity Manager / CISO

About the opportunity A leading Defence and national-security technology organisation is seeking a Cyber GRC Analyst to strengthen the governance, risk and compliance foundations that protect its systems, information and mission-critical capabilities. Reporting to the APAC Cybersecurity Manager/CISO, you will help ensure cyber security controls, policies and assurance activities meet the requirements of the ASD Information Security Manual (ISM), the Essential Eight and the broader Defence and government security landscape.

This is a hands-on governance role for someone who enjoys turning complex security requirements into practical, measurable and audit-ready outcomes. You will work closely with cyber security, engineering, architecture, program, procurement, legal and business stakeholders to assess risk, improve control maturity and support the secure delivery of Defence-related systems.

What you’ll do

- Map organisational policies and technical controls to the ASD Information Security Manual (ISM), Essential Eight, PSPF, NIST and other applicable Australian Government frameworks.
- Lead or support Assessment and Authorisation (A&A;) activities under the Cyber Security Assessment and Authorisation Framework (CSAAF), including System Security Plans (SSPs), Risk Management Plans and supporting artefacts to achieve and maintain an Authority to Operate (ATO).




- Conduct security risk assessments, business impact analyses, control-effectiveness reviews and third-party/vendor risk reviews against the ISM control baseline.
- Identify control gaps, assess security impacts and recommend practical, risk-based remediation and treatment options.
- Maintain and track Plans of Action and Milestones (POA&Ms;), remediation actions, risk acceptances, exceptions and mitigation activities through to closure.
- Maintain security documentation, control evidence and audit-ready records to support internal reviews, external audits and ongoing compliance obligations.
- Develop, review and maintain cyber security policies, standards, procedures and incident, continuity and disaster-recovery documentation.
- Use 6clicks to manage compliance activities, map controls across frameworks, maintain evidence, track risks and remediation actions, assess Essential Eight maturity and produce reporting for security and executive stakeholders.
- Partner with cyber security, engineering, architecture, program, procurement, legal and business teams to ensure security requirements are clearly understood, effectively implemented and demonstrably maintained.

What you’ll bring
- Experience in cyber security governance, risk and compliance (GRC),



security assurance or risk management within Defence, government, critical infrastructure or another highly regulated environment.
- Strong working knowledge of the ASD Information Security Manual (ISM) and Essential Eight, including control assessment, maturity assessment, gap analysis and remediation planning.
- Experience using 6clicks or an equivalent GRC platform to manage controls, evidence, risks, POA&Ms;, compliance reporting and multi-framework mappings.
- Experience supporting Assessment and Authorisation activities, including SSPs, Risk Management Plans, security assessment reports and ATO-related documentation.
- Familiarity with the PSPF, Defence security requirements and/or NIST frameworks.
- Strong analytical, written communication and stakeholder-engagement skills, with the ability to produce transparent, audit-ready documentation for technical and non-technical audiences.
- Understanding of secure system design, cloud and on-premises environments, identity and access management, vulnerability management, incident response and third-party risk.
- Australian citizenship and eligibility to obtain and maintain an appropriate Australian Government security clearance.

Desirable experience
- Experience supporting Australian Defence programs, classified systems or Defence security accreditation.
- Familiarity with the Defence Security Principles Framework (DSPF) and Defence Industry Security Program (DISP).
- Relevant certifications such as CISSP, CISM, CRISC, CISA, ISO/IEC 27001 Lead Implementer or Certified Essential Eight Assessor.

📌 Cyber GRC Analyst (Sydney)
🏢 Tardis Group
📍 Sydney