Cyber GRC Lead for ISO 27001 & AI Management

Revio Cyber Security; Sydney; On-site; AUD 130,000 - 170,000; Full time

Job summary

Revio Cyber Security, an Australian MSSP headquartered in Sydney, seeks a Cyber Governance, Risk and Compliance Specialist. You will own Revio’s certified ISMS and AI Management System, lead the enterprise cyber risk program, and deliver audits and advisory services to regulated clients.

The role combines policy development, auditing, and board‑level reporting, with client-facing duties across security frameworks, risk management, and vendor governance.

Qualifications

• Essential: bachelor's degree or higher in cyber security, information technology, information systems or related discipline.
• Experience in cyber security governance, risk and compliance including policy development and audits.
• Experience supporting ISO/IEC 27001 certification or surveillance audits.
• Strong knowledge of ISO/IEC 27001, NIST CSF 2.0, SOC 2, APRA CPS 234/230, CIS Controls v8, ACSC Essential Eight.

Responsibilities

• Own and maintain ISO/IEC 27001 and ISO/IEC 42001 information security and AI management systems.
• Develop, implement and measure cyber security policies and standards.
• Manage enterprise cyber risk program and risk registers.
• Conduct internal and client security audits against frameworks (NIST, ISO, ACSC, CIS Controls, CPS).
• Deliver governance advisory including due diligence, remediation roadmaps and board reporting.
• Design and operate third‑party risk management and vendor due diligence.
• Lead security awareness and phishing simulations for staff and executives.
• Define data classification and implement data protection measures across cloud and endpoints.

Job description

Revio Cyber Security, an Australian MSSP headquartered in Sydney, seeks a Cyber Governance, Risk and Compliance Specialist. You will own Revio’s certified ISMS and AI Management System, lead the enterprise cyber risk program, and deliver audits and advisory services to regulated clients.

The role combines policy development, auditing, and board‑level reporting, with client-facing duties across security frameworks, risk management, and vendor governance.