Consultant - Cyber Risk Consulting

Marsh; Sydney; Hybrid; AUD 90,000 - 130,000; Full time

Job summary

Marsh in Sydney or Perth is hiring a Consultant in Cyber Risk Consulting. The role is hybrid, requiring at least three days in the office weekly, based in Australia.

You will assess cyber risk, governance, and incident readiness, translating technical issues into business guidance and delivering high-quality consulting outputs with senior colleagues. Candidates typically have 2–4 years of cyber security or related consulting experience, strong communication, and familiarity with ISO 27001, NIST,

Qualifications

• 2–4 years of experience in cyber security, cyber risk, technology risk, or related consulting.
• Experience in risk assessments, security reviews, incident response planning, and/or cyber resilience work.
• Strong understanding of key cyber security concepts, frameworks, and control domains including governance, vulnerability management, IAM, cloud, and third‑party risk.
• Strong written and verbal communication; ability to explain technical matters to non‑technical audiences.
• Analytical, problem‑solving, and stakeholder management skills.

Responsibilities

• Support delivery of cyber risk consulting engagements, including risk assessments and tabletop exercises.
• Assess cyber security risks, vulnerabilities, impacts, and control gaps across people, process, technology, and third parties.
• Assist in incident response plans, playbooks, and board- or executive-level workshop materials.
• Contribute to client advisory work on governance, policies, security frameworks, and resilience roadmaps.
• Review and analyse security controls against frameworks and standards such as ISO 27001, NIST, CPS 234, ASD Essential Eight.
• Support evaluation of security technologies, vendors, and implementation approaches.

Skills

Cyber security

Risk assessment

Stakeholder management

Communication skills

Education

Relevant professional certifications (CISM, CISSP, CRISC, CISA)

Tools

ISO 27001

NIST

CPS 234

ASD Essential Eight

Job description

We are seeking a talented individual to join our Cyber Risk Consulting team at Marsh. This role will be based in Sydney OR Perth. This is a hybrid role that has a requirement of working at least three days a week in the office.

As a Consultant, you will support clients to improve cyber resilience by assessing cyber risk, strengthening governance and controls, supporting incident readiness, and advising on practical risk management improvements. You will work closely with senior consultants and client stakeholders across a range of industries, translating technical cyber issues into clear business advice and helping deliver high-quality consulting outputs.

We will count on you to:

• Support delivery of cyber risk consulting engagements, including cyber risk assessments, maturity reviews, control reviews, incident response readiness, and tabletop exercises.
• Assess cyber security risks, vulnerabilities, impacts, and control gaps across people, process, technology, and third-party environments.
• Assist in preparing incident response plans, playbooks, and board- or executive-level workshop materials.
• Contribute to client advisory work on cyber governance, policies, security frameworks, and resilience uplift roadmaps.
• Review and analyse security controls against relevant frameworks and standards such as ISO 27001, NIST, CPS 234, and ASD Essential Eight.
• Support the evaluation of security technologies, vendors, and implementation approaches that improve client security posture.
• Help quantify cyber risk and communicate findings in a way that supports decision-making and investment prioritisation.
• Build strong client and internal relationships, support business development activities, and contribute to proposals, thought leadership, and marketing initiatives.
• Work collaboratively with senior team members and provide guidance to junior colleagues where appropriate.

What you need to have:

• 2–4 years of experience in cyber security, cyber risk, technology risk, or a related consulting role.
• Experience in risk assessments, security reviews, incident response planning, and/or cyber resilience work.
• Sound understanding of key cyber security concepts, frameworks, and control domains, including governance, vulnerability management, identity and access management, cloud security, and third-party risk.
• Strong written and verbal communication skills, including the ability to explain technical matters to non-technical audiences.
• Strong analytical, problem-solving, and stakeholder management skills.

What makes you stand out:

• Knowledge of and experience working with frameworks and standards such as ISO 27001, NIST, CPS 234, and ASD Essential Eight.
• Professional certifications such as CISM, CISSP, CRISC, CISA, or equivalent.
• Ability to manage competing priorities, work well in a team, and operate effectively in a client-facing environment.
• Commercial awareness and an interest in developing advisory and consulting skills.

Why join our team:

• We help you be your best through professional development opportunities, interesting work and supportive leaders.
• We foster a vibrant and inclusive culture where you can work with talented colleagues to create new solutions and have impact for colleagues, clients and communities.
• Our scale enables us to provide a range of career opportunities, as well as benefits and rewards to enhance your well-being.

Marsh (NYSE: MRSH) is a global leader in risk, reinsurance and capital, people and investments, and management consulting, advising clients in 130 countries. With annual revenue of over $27 billion and more than 95,000 colleagues, Marsh helps build the confidence to thrive through the power of perspective. For more information, visit marsh.com, or follow us on LinkedIn and X.

Marsh is committed to creating a diverse, inclusive and flexible work environment. We aim to attract and retain the best people and embrace diversity of age, background, disability, ethnic origin, family duties, gender orientation or expression, marital status, nationality, parental status, personal or social status, political affiliation, race, religion and beliefs, sex/gender, sexual orientation or expression, skin color, or any other characteristic protected by applicable law. Applications will only be considered from candidates who have the appropriate approval to work in Australia. Successful applicants will be required to complete a Criminal & Bankruptcy check prior to commencing of employment.

Marsh is committed to hybrid work, which includes the flexibility of working remotely and the collaboration, connections and professional development benefits of working together in the office. All Marsh colleagues are expected to be in their local office or working onsite with clients at least three days per week. Office-based teams will identify at least one “anchor day” per week on which their full team will be together in person.