Cyber Risk Consultant: Governance and Incident Readiness

Marsh; Sydney; Hybrid; AUD 90,000 - 130,000; Full time

Job summary

Marsh in Sydney or Perth is hiring a Consultant in Cyber Risk Consulting. The role is hybrid, requiring at least three days in the office weekly, based in Australia.

You will assess cyber risk, governance, and incident readiness, translating technical issues into business guidance and delivering high-quality consulting outputs with senior colleagues. Candidates typically have 2–4 years of cyber security or related consulting experience, strong communication, and familiarity with ISO 27001, NIST,

Qualifications

• 2–4 years of experience in cyber security, cyber risk, technology risk, or related consulting.
• Experience in risk assessments, security reviews, incident response planning, and/or cyber resilience work.
• Strong understanding of key cyber security concepts, frameworks, and control domains including governance, vulnerability management, IAM, cloud, and third‑party risk.
• Strong written and verbal communication; ability to explain technical matters to non‑technical audiences.
• Analytical, problem‑solving, and stakeholder management skills.

Responsibilities

• Support delivery of cyber risk consulting engagements, including risk assessments and tabletop exercises.
• Assess cyber security risks, vulnerabilities, impacts, and control gaps across people, process, technology, and third parties.
• Assist in incident response plans, playbooks, and board- or executive-level workshop materials.
• Contribute to client advisory work on governance, policies, security frameworks, and resilience roadmaps.
• Review and analyse security controls against frameworks and standards such as ISO 27001, NIST, CPS 234, ASD Essential Eight.
• Support evaluation of security technologies, vendors, and implementation approaches.

Skills

Cyber security

Risk assessment

Stakeholder management

Communication skills

Education

Relevant professional certifications (CISM, CISSP, CRISC, CISA)

Tools

ISO 27001

NIST

CPS 234

ASD Essential Eight

Job description

Marsh in Sydney or Perth is hiring a Consultant in Cyber Risk Consulting. The role is hybrid, requiring at least three days in the office weekly, based in Australia.

You will assess cyber risk, governance, and incident readiness, translating technical issues into business guidance and delivering high-quality consulting outputs with senior colleagues. Candidates typically have 2–4 years of cyber security or related consulting experience, strong communication, and familiarity with ISO 27001, NIST,