Governance, Risk and Compliance (GRC) Analyst

Established in 1915 and run by fourth generation Haigh’s family, Haigh’s Chocolates is the oldest family-owned chocolate maker in Australia. The company currently employs over 900 people across its retail and online stores, three factories, and head office, and will be expanding from 22 to 26 retail stores in Adelaide, Brisbane, Melbourne, Sydney, and Canberra by the end of 2026.

Haigh’s prides itself on being a chocolate ‘bean to bar’ specialist, committed to the art of premium chocolate making, roasting cocoa beans to create a unique blend of milk and dark chocolate. Haigh’s are the largest Australian importer of raw cocoa beans, ethically sourced from cocoa plantations around the world, using only the finest and freshest ingredients.

Through meticulous artisan skills that include handmade chocolate creation and finishing, combined with advanced manufacturing equipment and techniques, Haigh’s creates exquisite chocolates that look and taste delicious.

We’re looking for a Governance, Risk and Compliance (GRC) Analyst to join our Technology team, reporting to the Head of Technology. Based at our Parkside Head Office, with the opportunity to also work from our Salisbury South Complex, you’ll help strengthen our cybersecurity governance, manage compliance activities and ensure our security controls are consistently monitored and improved.

This is a hands-on role combining IT security knowledge, administration and project coordination, with the opportunity to make a meaningful impact across our manufacturing, retail and support functions.

What will you be doing?

• Coordinating our Essential Eight cybersecurity maturity program and tracking remediation activities.
• Help improve Essential Eight compliance across the business, and support quarterly reporting to the Board and DSC on our security and privacy obligations, including the Australian Privacy Principles and the Notifiable Data Breaches scheme.
• Managing vendor risk assessments, user access reviews and compliance evidence.
• Maintaining cybersecurity policies, risk registers and incident response documentation.
• Coordinating security audits, vulnerability management activities and staff awareness training.
• Working with external security partners to monitor controls and ensure agreed actions are completed.
• Preparing clear, accurate compliance reports and audit documentation for senior stakeholders.
• Partnering with teams across Haigh’s to embed practical and effective security practices.

What will make you successful?

You’re organised, proactive and comfortable managing multiple priorities. You enjoy bringing structure to complex activities, following through on commitments and making sure the details are right.

You’ll bring:

• At least three years’ experience in GRC, cybersecurity, IT security, IT audit or a related field.
• An understanding of frameworks such as the Essential Eight, NIST CSF, ISO 27001 or PCI DSS.
• Strong administration, project coordination, documentation and reporting skills.
• Clear communication skills and the ability to translate technical requirements into practical actions.
• A solutions-focused approach, with the initiative to identify gaps and drive improvements.

Experience with Microsoft 365 security and compliance tools and third-party risk management platforms will be highly regarded.

Why join Haigh’s?

At Haigh’s, we’re proud of our history, our people and the products we make. You’ll be joining a friendly, down-to-earth team where people work together and support one another. Along with the opportunity to make a real impact in a well-established South Australian business, you’ll enjoy our short-term incentive scheme, plenty of chocolate to eat on site and a range of other great benefits.

Inclusion matters at Haigh's. We believe that valuing differences in backgrounds, cultures, abilities and experiences helps create a workplace free from bias and prejudice. We're committed to making reasonable adjustments throughout our recruitment process and beyond, to ensure a barrier-free and supportive experience for all.