Senior GRC Analyst
Summary
A 6-month contract role, recruited by Talenza for a Brisbane financial services organisation, working in a mature cyber GRC function: controls testing and framework maturity, third-party/vendor risk management, technical risk assessments with engineering stakeholders, and internal/external audit coordination supporting a NIST-aligned ISMS. Hybrid, 3 days on-site per week.
About The Role
Talenza are partnering with a Brisbane-based organisation in the financial services sector to recruit a Senior Information Security GRC Analyst for an initial 6-month contract.
This role is heavily involved in controls testing and framework maturity, third-party risk management, technical risk assessments with engineering stakeholders, and audit coordination (internal and external). You'll also support the organisation's ISMS aligned to NIST, helping embed risk into technology decision-making in a practical, delivery-friendly way.
Benefits
- Initial 6 month day rate contract
- Hybrid working (3 days on-site per week)
- Fast-paced, collaborative and social environment
- Work with a mature Cyber GRC function and strong internal stakeholders
Skills (Requirements)
- Strong Cyber GRC background with proven delivery across governance, risk and compliance outcomes
- At least 5 years' experience as a GRC Analyst or 2 years as a Senior GRC Analyst
- Controls testing uplift experience and ability to improve framework maturity
- Third-party / vendor risk management experience
- Strong technical risk assessment capability with stakeholders across cloud, architecture and security controls
- Internal and external audit coordination experience (evidence, findings, remediation tracking)
- Experience supporting an ISMS and policy uplift (NIST-aligned approach preferred)
You will be responsible for:
- Enhancing and maintaining security governance, controls testing and risk management frameworks.
- Managing third-party security risk, including vendor due diligence and ongoing assessments.
- Conducting security and compliance assessments across systems, processes and technologies.
- Monitoring key risk indicators and producing governance, risk and compliance reporting for management.
- Supporting the development and maintenance of technology risk registers and business impact assessments.
- Providing security risk and controls guidance to technology and broader business teams.
- Supporting internal and external audits and responding to regulatory requirements.
- Maintaining awareness of emerging security risks, regulatory changes and industry trends.
- Building strong stakeholder relationships and promoting a positive security and risk culture across the organisation.