Cyber GRC Lead | Brisbane | $185-195k base | Permanent

Decipher Bureau; Brisbane; Hybrid; AUD 185,000 - 195,000; Full time

Benefits offered by this job

Extra paid parental leave

Fuel discount for you and your family

Salary packaging and discountedPrivate

Tenure bonuses, travel and employee |

Job summary

Decipher Bureau is seeking a Cyber GRC Lead to own the ISO 27001 ISMS and drive governance across IT and OT. You will report to the Head of Information Security within a SOCI-regulated environment and influence both internal teams and external partners.

The role emphasises architectural input, risk management, and a broad program leadership approach. Based near Brisbane with a hybrid schedule, the role offers a strong impact across the business and growth opportunities.

Qualifications

• 5+ years in information security governance, risk and compliance, ideally in critical infrastructure, energy, utilities or financial services
• Hands-on experience operating an ISO 27001 ISMS, including internal audit, management review and the SoA
• Experience implementing or measuring against Essential Eight, CIS Controls, NIST, PCI-DSS or IEC 62443
• Risk register management and reporting to management or board level
• Enough technical depth to contribute in architecture reviews and change advisory
• Certs like CISSP, CISM, CRISC or CISA, with ISO 27001 Lead Implementer or Lead Auditor highly regarded
• Full working rights in Australia, No sponsorship.

Responsibilities

• Running the ISO 27001 ISMS: internal audit schedule, management reviews, SoA, policy suite and security committee
• Map ISMS to Essential Eight and CIS Controls for IT, IEC 62443 for OT
• Own the technology risk register, risk assessments, remediation and exceptions
• Support SOCI and CIRMP compliance, OAIC obligations with Legal/Procurement
• Oversee vulnerability management across IT and OT, including remediation SLAs
• Run third-party and supplier risk assessments against critical suppliers
• Hold MSSP, pentesters and security partners to measurable outcomes
• Help build OT security governance with OT team
• Support awareness training, phishing simulations, tabletop exercises and post-incident reviews

Skills

GRC foundations

Information security

Architecture reviews

Risk management

Vendor risk

Regulatory compliance

Education

CISSP

CISM

CRISC

CISA

ISO 27001 Lead Implementer

ISO 27001 Lead Auditor

Tools

Entra

Purview

Defender

Tenable

Qualys

Rapid7

Job description

Cyber GRC Lead | Brisbane | $185-195k base | Permanent

Hey there, GRC folks. Been auditing ISMSs for years and want one to call your own? Keen to work across IT and OT in a SOCI-regulated business? Want a role where you’re expected to hold your own in architecture reviews, not just update the risk register? Read on.

Before the detail, here’s what’s in it for you in this permanent role:

• Extra paid parental leave
• Fuel discount for you and your family
• Salary packaging and discounted private health insurance
• Tenure bonuses, plus travel and employee discount programs
• EAP for you and your immediate family, and annual flu vaccinations
• An annual family fun day, with activities for the whole family

• $185-195k base salary
• Extra paid parental leave
• Fuel discount for you and your family
• Salary packaging and discounted private health insurance
• Tenure bonuses, plus travel and employee discount programs
• EAP for you and your immediate family, and annual flu vaccinations
• An annual family fun day, with activities for the whole family

So, who are they and why does this role exist?

You’ll be joining a privately owned national business with 40+ years behind it and 450+ staff. They’re on track to 4x revenue over the next five years, and recent private equity investment has put governance maturity and cyber firmly on the agenda. That’s where you come in. The environment includes SOCI-regulated critical infrastructure with OT, a team of around 50 in ICT, and in-house built business platforms.

What you’ll be doing

You’ll sit in a small second-line Information Security team, reporting to the Head of Information Security. Your job is to set the standard and assure delivery, while Operations, Engineering and OT own implementation and remediation. You’ll work alongside an internal security analyst and an external MSSP-run SOC.

• Running the ISO 27001 ISMS: internal audit schedule, management reviews, Statement of Applicability, policy suite and the security management committee
• Mapping the ISMS to Essential Eight and CIS Controls for IT, and IEC 62443 for OT, so maturity can be measured and reported
• Owning the technology risk register, risk assessments, and remediation and exception tracking
• Supporting SOCI and CIRMP compliance, and staying across Privacy Act and OAIC obligations with Legal and Procurement
• Overseeing vulnerability management across IT and OT, including remediation SLAs
• Running third-party and supplier risk assessments against the critical supplier population
• Holding the MSSP, pentesters and other security partners to measurable outcomes
• Helping build OT security governance with the OT team
• Supporting awareness training, phishing simulations, tabletop exercises and post-incident reviews

It’s worth knowing up front: the role is based just outside the city with 3-4 days in the office and 1-2 from home each week. No direct reports, but plenty of influence across the business.

What you’ll need

This one suits someone with solid GRC foundations and real technical depth, who wants to own a program rather than hand over a report and move on. You’ll likely bring:

• 5+ years in information security governance, risk and compliance, ideally in critical infrastructure, energy, utilities or financial services
• Hands-on experience operating an ISO 27001 ISMS, including internal audit, management review and the SoA
• Experience implementing or measuring against Essential Eight, CIS Controls, NIST, PCI-DSS or IEC 62443
• Risk register management and reporting to management or board level
• Enough technical depth to contribute in architecture reviews and change advisory
• Certs like CISSP, CISM, CRISC or CISA, with ISO 27001 Lead Implementer or Lead Auditor highly regarded
• Full working rights in Australia, No sponsorship.

Bonus points for:

• OT, SCADA or industrial control system exposure
• Working knowledge of SOCI / CIRMP
• Microsoft security tools like Entra, Purview and Defender
• Vulnerability management tools like Tenable, Qualys or Rapid7

Decipher Bureau and the clients we partner with are committed to creating a diverse environment and are proud to be equal opportunity employers. All qualified applicants will be considered for employment without attention to race, colour, religion, sex, sexual orientation, gender identity, national origin, veteran, or disability status.

Additional information

• Own the ISMS day to day
• IT and OT across fuel terminals
• Perm, Hybrid, QLD