Senior GRC Security Consultant

Salary: $150,000 – $180,000 per year

About the role

The Security Consultant – GRC delivers high-quality governance, risk and compliance engagements across a portfolio of Spartans Security clients. The role provides hands-on consulting and trusted advisory support, helping customers understand cyber risk, meet regulatory and contractual obligations, strengthen security controls and progress practical improvement roadmaps. You will work across multiple accounts/customers in a vCISO capacity, plus some project work.

Key responsibilities

• Independently deliver cybersecurity consulting engagements related to security GRC, including conducting assessments/reviews against NIST CSF, ISO27001, ASD Essential 8 or similar

• Create security roadmaps and security budgets for customers

• Uplift customers' current incident response plans

• Create/uplift customers' current policies and procedures

• Present security reports and perform incident response exercises with IT Teams and Executives

• Lead vCISO advisory services and chair the information security risk management committee

• Engage with customer stakeholders at various levels, from helpdesk to directors, including external parties such as managed service providers and vendors

• Provide advice as a subject matter expert (SME) on various security operational processes such as incident management, vulnerability management, system hardening, and security governance

• Act as a key trusted security governance and assurance liaison/facilitator for key stakeholders, vendors and suppliers

• Maintain IT/Cyber Security Risk Registers to continuously track and drive mitigation and resolution efforts

About you

• Experience working as a Cybersecurity Consultant, IT Security Advisor, GRC consultant, IT Security Manager or similar roles across multiple and concurrent projects and industry verticals for at least 5-10 years

• Capable of leading projects and managing the end-to-end project lifecycle, including drafting proposals, billing and invoicing

• Knowledge of managing a consulting practice, including project resource utilisation and profitability management

• Ability to communicate with technical and non-technical executives, deliver presentations on various topics to key business stakeholders, deliver seminars and lead cyber incident response tabletop exercises

• Strong knowledge and experience across a range of security standards and frameworks (e.g. APRA CPS234, SOCI, ISM/PSPF, Essential Eight, NIST CSF, PCI DSS, ISO/IEC 27001)

• Deep understanding of cybersecurity auditing and assessment methodologies and expertise in writing high-quality reports for technical and executive audiences

• Solid technical background in on-premises and cloud-based technology environments, such as Microsoft AD, AWS, and Azure

• Have one or more current industry certifications, such as CISM, CISSP, CISA, SABSA, ISO27001 LI/LA, or CRISC

• In-depth understanding and practical implementation of information security risk management processes

• Able to work independently and negotiate and influence adherence to security controls and requirements

About us

Spartans Security is an Australian cybersecurity consultancy and trusted partner to organisations seeking practical, resilient protection from evolving digital threats. We listen, understand and deliver tailored services across governance, risk and compliance (GRC), virtual CISO advisory, security assessments, incident response, Microsoft security, penetration testing, cloud security and managed security. Our team combines deep technical expertise with clear business advice to protect valuable information assets and strengthen customer confidence.