Senior Information Risk Analyst

About Us

We're a New Zealand company helping governments around the world modernise their tax systems. Our clients span South America, the Caribbean, the Pacific and Europe. We're proud to contribute to public sector reform and align our technology with our clients' visions.

We're a family friendly workplace that celebrates diversity and encourages you to bring your whole self to work. Because our clients are located worldwide, we look for team players who are open to learning about different cultures and experiencing different approaches to work.

About the role

This is a six-month fixed term role, covering a period of parental leave. We're a small security team responsible for DataTorque's security posture and our ISO 27001 certification programme. We have a solid policy framework and a documented ISMS behind us. The next step is maturity, moving day to day control ownership out to the people who do the work, with security in support rather than in the middle.

This role exists to make that shift real. You'll split your time between hands-on security and GRC work, and working directly with process owners across IT, HR, finance and operations, helping them understand, take on and sustain ownership of the controls that touch their teams.

You'll join us at an important point, right in the middle of active ISO 27001 certification preparation, so there's real work to get stuck into from day one.

What you will be doing

• Assist with day-to-day security operations and GRC administration, including evidence collection, control monitoring, audit preparation and incident support
• Lead handover conversations that move ISO 27001 controls from security owning them to process owners owning them, with security in support
• Build and maintain a control ownership map, including RACI responsibilities, and keep it current as the business changes
• Work with department heads to confirm risk ownership across open treatment actions in Vanta
• Translate ISO 27001 requirements into language and workflows that make sense to non-security teams
• Support process owners as they learn the controls they now own
• Contribute to our certification programme, including documentation, internal audits and management review inputs

What you will bring

• Experience with ISO 27001, SOC 2 or a comparable security or compliance framework
• A track record of getting a non-security team to genuinely own a security behaviour or control
• Confidence engaging department managers and helping them understand what they own and why it matters
• Working knowledge of core security domains such as access management, change management, vendor risk and incident response
• Hands-on experience with Vanta or a comparable GRC platform
• Clear, plain language written and verbal communication
• The right to work in New Zealand

Why work with us?

Yes, the work is interesting and meaningful, but our culture is what truly sets us apart.

We're collaborative, down to earth and inclusive. You'll be part of a team that cares about quality and cares about each other. Whether it's brainstorming over coffee, dragon boating or afterhours board games, we enjoy what we do and appreciate who we do it with.

We celebrate individuality and diverse perspectives. You'll be supported to be yourself and bring your strengths to the table, while working with clients around the world and growing your experience beyond New Zealand. You'll also work with modern AI tools as part of how we build software day to day, and benefit from regular events like hack days and wellness benefits, with the time and space to keep learning and look after your wellbeing.

If you'd like more information on who we are, visit our website (www.datatorque.com) or reach out to us on recruitment@datatorque.com