Senior Governance, Risk

• At least eight years of experience in Governance, Risk & Compliance, cybersecurity assurance, internal audit, technology risk, or risk consulting

• Proven experience delivering client-facing cybersecurity risk, compliance, and maturity assessments

• Ability to independently conduct stakeholder interviews, gather and evaluate evidence, assess controls, and document findings

• Experience preparing detailed assessment reports, executive risk summaries, and prioritised remediation recommendations

• Strong understanding of cybersecurity governance, enterprise risk management, and compliance principles

• Experience collaborating with technical engineers, cybersecurity specialists, business stakeholders, and senior leadership

• Ability to manage multiple assessment activities while maintaining high standards of accuracy and professionalism

Cybersecurity Frameworks & Risk Management

• Strong working knowledge of ISO/IEC 27001, including ISMS requirements, risk assessment, control evaluation, and implementation maturity

• Demonstrated experience assessing organisations against the ASD Essential Eight maturity model

• Strong understanding of NIST Cybersecurity Framework 2.0 and its application to risk management and organisational maturity

• Experience conducting control gap analyses, cybersecurity maturity assessments, and compliance readiness reviews

• Understanding of risk registers, inherent and residual risk, control effectiveness, and risk treatment strategies

• Knowledge of cybersecurity governance, incident management, third-party risk, business continuity, and disaster recovery

AI Governance & Data Protection

• Experience in AI governance, data governance, or related risk and compliance disciplines

• Working knowledge of ISO/IEC 42001 or other recognised AI governance and risk management frameworks

• Understanding of risks associated with organisational AI adoption, including privacy, security, accountability, transparency, and governance

• Knowledge of data classification, data protection controls, information lifecycle management, and privacy principles

• Ability to assess governance practices and recommend practical improvements

Audit, Assurance & Evidence Management

• Experience developing or applying structured audit and assurance methodologies

• Strong understanding of evidence collection, sampling, control testing, and audit working paper standards

• Ability to distinguish between control design, implementation, and operating effectiveness

• Experience documenting objective findings that are traceable to supporting evidence

• Understanding of assessment independence, quality assurance, and professional ethics

• Ability to produce defensible assessment conclusions for management and external stakeholders

Regulatory & Industry Knowledge

• Experience working with Australian organisations, particularly in regulated sectors such as financial services, healthcare, government, or critical infrastructure, is advantageous

• Familiarity with APRA CPS 234, APRA CPS 230, the Security of Critical Infrastructure Act, the Australian Privacy Act 1988, and Australian Privacy Principles is desirable

• Knowledge of SOC 2, ISO/IEC 27701, ISO 22301, and other relevant assurance frameworks is beneficial

• Understanding of the NIST AI Risk Management Framework is advantageous

• Experience with GRC platforms, risk registers, compliance management systems, or evidence management tools is beneficial

• Experience providing ongoing GRC advisory services, virtual CISO support, or continuous compliance assurance is highly regarded

• Familiarity with Microsoft Purview, Microsoft Defender, Microsoft Entra ID, and Azure governance is beneficial

Reporting, Communication & Consulting

• Exceptional written English and the ability to produce polished reports for senior executives and Boards

• Ability to translate complex technical and compliance matters into clear business risks and actionable recommendations

• Strong presentation, workshop facilitation, and stakeholder engagement skills

• Experience preparing executive summaries, risk dashboards, maturity assessments, and remediation roadmaps

• Confidence communicating difficult findings constructively and professionally

• Strong analytical thinking, attention to detail, and structured problem-solving abilities

Professional Attributes

• Sound professional judgement and the ability to reach objective, ev