• At least eight years of experience in Governance, Risk & Compliance, cybersecurity assurance, internal audit, technology risk, or risk consulting • Proven experience delivering client-facing cybersecurity risk, compliance, and maturity assessments • Ability to independently conduct stakeholder interviews, gather and evaluate evidence, assess controls, and document findings • Experience preparing detailed assessment reports, executive risk summaries, and prioritised remediation recommendations • Strong understanding of cybersecurity governance, enterprise risk management, and compliance principles • Experience collaborating with technical engineers, cybersecurity specialists, business stakeholders, and senior leadership • Ability to manage multiple assessment activities while maintaining high standards of accuracy and professionalism Cybersecurity Frameworks & Risk Management • Strong working knowledge of ISO/IEC 27001, including ISMS requirements, risk assessment, control evaluation, and implementation maturity • Demonstrated experience assessing organisations against the ASD Essential Eight maturity model • Strong understanding of NIST Cybersecurity Framework 2.0 and its application to risk management and organisational maturity • Experience conducting control gap analyses, cybersecurity maturity assessments, and compliance readiness reviews • Understanding of risk registers, inherent and residual risk, control effectiveness, and risk treatment strategies • Knowledge of cybersecurity governance, incident management, third-party risk, business continuity, and disaster recovery AI Governance & Data Protection • Experience in AI governance, data governance, or related risk and compliance disciplines • Working knowledge of ISO/IEC 42001 or other recognised AI governance and risk management frameworks • Understanding of risks associated with organisational AI adoption, including privacy, security, accountability, transparency, and governance • Knowledge of data classification, data protection controls, information lifecycle management, and privacy principles • Ability to assess governance practices and recommend practical improvements Audit, Assurance & Evidence Management • Experience developing or applying structured audit and assurance methodologies • Strong understanding of evidence collection, sampling, control testing, and audit working paper standards • Ability to distinguish between control design, implementation, and operating effectiveness • Experience documenting objective findings that are traceable to supporting evidence • Understanding of assessment independence, quality assurance, and professional ethics • Ability to produce defensible assessment conclusions for management and external stakeholders Regulatory & Industry Knowledge • Experience working with Australian organisations, particularly in regulated sectors such as financial services, healthcare, government, or critical infrastructure, is advantageous • Familiarity with APRA CPS 234, APRA CPS 230, the Security of Critical Infrastructure Act, the Australian Privacy Act 1988, and Australian Privacy Principles is desirable • Knowledge of SOC 2, ISO/IEC 27701, ISO 22301, and other relevant assurance frameworks is beneficial • Understanding of the NIST AI Risk Management Framework is advantageous • Experience with GRC platforms, risk registers, compliance management systems, or evidence management tools is beneficial • Experience providing ongoing GRC advisory services, virtual CISO support, or continuous compliance assurance is highly regarded • Familiarity with Microsoft Purview, Microsoft Defender, Microsoft Entra ID, and Azure governance is beneficial Reporting, Communication & Consulting • Exceptional written English and the ability to produce polished reports for senior executives and Boards • Ability to translate complex technical and compliance matters into clear business risks and actionable recommendations • Strong presentation, workshop facilitation, and stakeholder engagement skills • Experience preparing executive summaries, risk dashboards, maturity assessments, and remediation roadmaps • Confidence communicating difficult findings constructively and professionally • Strong analytical thinking, attention to detail, and structured problem-solving abilities Professional Attributes • Sound professional judgement and the ability to reach objective, evidence-based conclusions • Strong integrity, independence, and willingness to challenge unsupported claims • A practical consulting mindset focused on customer objectives and meaningful business outcomes • Commercial awareness and the ability to balance security, risk, regulatory obligations, and operational realities • Strong collaboration skills while maintaining accountability for independent assurance conclusions • Commitment to keeping up to date with evolving cybersecurity frameworks, regulations, emerging risks, and AI governance requirements • Ownership of assessment quality, completeness, and delivery Preferred Certifications Candidates should ideally hold one or more of the following certifications or demonstrate equivalent professional knowledge and experience: • ISO/IEC 27001 Lead Auditor • ISO/IEC 27001 Lead Implementer • Certified Information Systems Auditor (CISA) • Certified Information Security Manager (CISM) • Certified in Risk and Information Systems Control (CRISC) • IAPP Artificial Intelligence Governance Professional (AIGP) • ISACA Advanced in AI Audit (AAIA) • ISO/IEC 42001 Lead Auditor or Lead Implementer Additional qualifications in risk management, privacy, cybersecurity governance, or relevant regulatory frameworks will be highly regarded. Responsibilities Cybersecurity Risk & Compliance Assessments • Plan, coordinate, and deliver cybersecurity readiness, gap, and maturity assessments for commercial and regulated customers • Assess organisations against recognised frameworks, including ISO/IEC 27001, ASD Essential Eight, NIST Cybersecurity