Cyber Governance Risk & Compliance Lead

CityFM; Melbourne; On-site; AUD 180,000 - 240,000; Full time

Job summary

CityFM is seeking a Cyber GRC Lead to drive ISO/IEC 27001 certification and build a robust Information Security Management System across the organisation. Reporting to the GM - Infrastructure & Security, you will coordinate risk assessments, gap analyses and control design with Technology, Quality and business units.

You will lead certification readiness, audits, and ongoing improvement of information security policies, privacy obligations and third‑party risk programs, while partnering with

Qualifications

• Bachelors in information security or related field.
• 5+ years in cyber security governance, risk & compliance or information security management.
• Experience leading ISO/IEC 27001 certification programs.
• Hands-on ISMS establishment and ongoing improvements.

Responsibilities

• Lead end-to-end ISO/IEC 27001 certification program.
• Coordinate gap assessments, risk assessments and SoA development.
• Manage certification readiness activities, internal and external audits.
• Maintain certification roadmaps, evidence repositories and readiness reporting.
• Drive accountability across information asset owners and control owners.
• Develop and review security policies, standards and procedures.
• Ensure alignment with ISO 27001, privacy obligations and contractual requirements.
• Maintain cyber risk registers and oversee risk treatment activities.
• Facilitate cyber risk assessments across systems, projects and processes.

Skills

Stakeholder engagement

Communication

Influencing skills

Cyber risk management

Education

Bachelor's degree in Information Security, Risk Management or related discipline

ISO/IEC 27001 Lead Implementer

CISSP/CRISC/CISA or similar certifications

Job description

Are you an experienced Cyber Governance, Risk & Compliance professional ready to lead a transformational security program?

We are seeking a Cyber Governance Risk & Compliance (GRC) Lead to drive our ISO/IEC 27001 certification program and establish a best-practice Information Security Management System (ISMS). This influential role offers the opportunity to shape cyber governance across the business and play a critical role in strengthening our overall security posture.

Why Join Us?

• Lead a high-profile ISO 27001 certification program
• Shape cyber governance across a national organisation
• Partner with executive leaders and key business stakeholders
• Drive continuous improvement in cyber risk, compliance and assurance
• Join a collaborative and supportive technology team
• Work on strategic initiatives that directly influence organisational resilience

The Opportunity

Reporting to the General Manager - Infrastructure & Security, you will be responsible for leading the implementation, operation and continual improvement of the organisation's Information Security Management System (ISMS).

You will work closely with stakeholders across Technology, Quality and broader business functions to ensure security controls are effectively implemented, monitored and aligned to organisational, regulatory and contractual requirements.

Key Responsibilities

• Lead the end-to-end ISO/IEC 27001 certification program
• Coordinate gap assessments, risk assessments and Statement of Applicability development
• Manage certification readiness activities, internal audits and external certification audits
• Maintain certification roadmaps, evidence repositories and readiness reporting
• Drive accountability across information asset owners, risk owners and control owners
• Establish, maintain and continuously improve the Information Security Management System
• Develop and review security policies, standards and procedures
• Ensure alignment with ISO 27001, privacy obligations and contractual requirements
• Maintain the cyber risk register and oversee risk treatment activities
• Facilitate cyber risk assessments across systems, projects and business processes

Third-Party Risk & Assurance

• Manage third-party and supply chain cyber risk programs
• Conduct cyber security due diligence and ongoing vendor assurance activities
• Coordinate responses to customer, auditor and insurer security assessments
• Monitor remediation activities and control effectiveness across suppliers
• Develop cyber maturity metrics and security performance reporting
• Report on security risks, audit outcomes, control effectiveness and certification readiness
• Drive corrective actions, audit remediation and continuous improvement initiatives
• Present meaningful insights and recommendations to governance forums and senior leadership

About You

To be successful in this role, you will bring:

• Bachelor's degree in Information Security, Risk Management or a related discipline
• Minimum 5 years' experience in Cyber Security Governance, Risk & Compliance or Information Security Management
• Demonstrated experience leading or supporting ISO/IEC 27001 certification programs
• Hands-on experience establishing and maintaining an ISMS
• Strong understanding of cyber risk management frameworks and methodologies
• Experience maintaining risk registers and coordinating risk treatment plans
• Excellent stakeholder engagement, communication and influencing skills
• ISO/IEC 27001 Lead Implementer and/or Lead Auditor certification
• CISSP, CRISC, CISA or similar industry-recognised certifications
• Experience with NIST Cyber Security Framework, Essential Eight and related standards
• Knowledge of privacy, data governance and third-party risk management practices

What Success Looks Like

You will successfully deliver ISO 27001 certification, establish a sustainable governance framework, improve cyber risk visibility across the organisation and strengthen assurance capabilities through effective governance, reporting and stakeholder engagement.