Senior Governance, Risk & Compliance (GRC) Analyst - WFH / Australian Client

Are you looking for a supportive and collaborative workplace with great benefits and clear career development? You've come to the right place.

We are seeking a Senior Governance, Risk & Compliance (GRC) Analyst for our client, a leading SaaS provider of streamlined digital customer acquisition, identity verification, and onboarding technology to the financial services industry globally.

Qualifications & experience

• 5+ years of experience in Information Security GRC, IT Risk, or IT Audit, with end-to-end ownership of at least one ISO 27001 certification or SOC 2 Type II audit.

• ISO 27001 Lead Implementer or Lead Auditor certification required; CISA, CRISC, CISM, or equivalent is an advantage.

• Hands-on experience with GRC compliance automation tools, preferably Vanta, Drata, or Secureframe.

• Working knowledge of SOC 2 Trust Services Criteria and GDPR; APRA CPS 234 or other financial services regulations is an advantage.

• Proven experience managing security questionnaires, vendor due diligence, and RFP responses for enterprise or financial services clients.

• Strong stakeholder management skills, with the ability to coordinate cross-functional teams, set deadlines, follow up, and challenge incomplete or inconsistent responses.

• Practical understanding of AWS, Microsoft 365/Entra ID, and Intune to review technical evidence and identify potential gaps.

• Experience in third-party risk management and user access reviews.

• Daily experience using AI tools such as ChatGPT, Claude, or Copilot for research, drafting, and analysis, including reusable prompts or knowledge bases, with the ability to validate outputs before external use.

• Excellent organizational skills, problem solving, attention to detail, effective & professional communication with client.

• Ability to work independently at a high level without constant supervision.

• Excellent English communication skill, both written and verbal.

Tasks & responsibilities

Core Duties

• Manage client security due diligence end to end, including security questionnaires, vendor risk assessments, RFPs, tenders, and customer assurance requests.

• Coordinate cross-functional stakeholders across different department to deliver accurate, consistent, and timely responses.

• Maintain client-specific security records covering contractual obligations, previous responses, agreed controls, supporting evidence, and outstanding commitments.

• Develop and maintain a central assurance library of standard responses, evidence packs, policies, and certifications.

• Use AI to streamline assurance workflows, including drafting responses, matching requests to existing evidence, analysing controls, and building reusable prompts and searchable knowledge bases. Verify all outputs before external use.

• Manage company’s ISO 27001 Information Security Management System (ISMS), including the security calendar, policies, standards, scheduled reviews, and required approvals.

• Maintain the information security risk register, facilitate quarterly risk reviews, and track treatment plans and corrective actions through to closure.

• Drive compliance across ISO 27001, SOC 2, GDPR, and APRA CPS 234 using Vanta, including control mapping, evidence collection, control ownership, and remediation tracking.

• Coordinate internal and external audits, including ISO 27001 surveillance audits, auditor liaison, evidence preparation, and post-audit corrective actions.

• Manage third-party security risk, including critical supplier assessments, contractual security requirements, and ongoing risk monitoring.

• Coordinate quarterly user and privileged access reviews across corporate and production systems, ensuring access records and review evidence are complete.

• Oversee managed IT service provider governance, reviewing monthly reports for SLA breaches, access issues, unapproved software, and endpoint compliance, and following up on findings.

• Monitor software licences, SaaS usage, and costs, including Microsoft 365 and Copilot, and identify opportunities to optimize spending.

• Maintain software and asset security records, including the approved software register, deployment approvals, asset audit results, and secure device disposal evidence.

• Manage security awareness and phishing simulations, track completion and click rates, and follow up on overdue training.

• Coordinate incident response and business continuity/disaster recovery exercises, including scenario planning, documentation, and follow-up actions.

• Prepare monthly, quarterly, and annual security reports, including ISMS performance reports, management review inputs, and executive or board briefings.

• Monitor changes in security standards, regulations, and client contractual requirements, assessing their impact on company’s compliance program.