Cyber Risk & Compliance Programme Lead

Profectus; Canberra; On-site; AUD 150,000 - 210,000; Full time

Job summary

Profectus seeks an experienced Cyber Security Program Manager with a governance, risk and compliance (GRC) focus to uplift cyber maturity. You will assess current maturity, map regulatory obligations, develop risk management processes, and produce roadmaps, business cases and Board reporting to support multi-year uplift.

Requires seven years in cyber security with GRC, assurance or uplift roles. Responsibilities include policy development, cyber governance, risk registers, and stakeholder

Qualifications

• Minimum seven years in cyber security, including GRC, assurance or uplift roles.
• Experience applying ISO 27001, NIST CSF or Essential Eight in practical uplift.
• Ability to develop cyber risk registers and risk reporting.
• Proven track record in policy standards and governance design.
• Experience building costed multi-year cyber roadmaps.
• Experience presenting to executives and boards.

Responsibilities

• Assess current cyber maturity against ISO 27001, NIST CSF and Essential Eight.
• Map regulatory obligations and track the organisation's compliance posture.
• Develop and maintain cyber risk management approaches and risk reporting.
• Develop cyber security policies, standards and governance structures.
• Contribute to strategy and a costed uplift roadmap with business cases.
• Prepare investment-ready business cases with options, costs and benefits.
• Design governance structures including committees and reporting lines.
• Prepare risk and assurance reporting for executives and Board.
• Coordinate audits and track remediation of findings.
• Run workshops with business, IT and OT stakeholders to agree priorities.

Skills

GRC leadership

Cyber risk management

Policy development

Stakeholder engagement

Executive reporting

Business writing

Job description

Profectus seeks an experienced Cyber Security Program Manager with a governance, risk and compliance (GRC) focus to uplift cyber maturity. You will assess current maturity, map regulatory obligations, develop risk management processes, and produce roadmaps, business cases and Board reporting to support multi-year uplift.

Requires seven years in cyber security with GRC, assurance or uplift roles. Responsibilities include policy development, cyber governance, risk registers, and stakeholder