Governance, Risk & Compliance Program Manager

Mission Critical Recruitment; Sydney; On-site; AUD 180,000 - 280,000; Full time

Job summary

Mission Critical Recruitment is seeking a senior GRC leader to own governance, risk and compliance across data centre OT and ICT estates. You will drive ISO 27001 alignment, implement a new GRC platform, and map controls across the business in Australia.

The role is greenfield and requires building the function, platform and team with clear executive reporting and audits.

Qualifications

• Significant GRC, risk or assurance experience in data centres or critical infrastructure.
• Hands-on ISO 27001 implementation, ideally leading through certification.
• Knowledge of Australian requirements like SOCI Act and Essential Eight.

Responsibilities

• Set the GRC strategy, roadmap and operating model for data centre OT and ICT.
• Lead ISO 27001 alignment and certification, including country-specific controls.
• Select and implement a GRC platform, and build the control library, testing and reporting.

Skills

GRC management

ISO 27001 implementation

risk management

auditing

vendor security

Education

Bachelor's degree in IT/Computer Science

Tools

ServiceNow IRM

Archer

OneTrust

Job description

A hyperscale data centre developer and operator with campuses across APAC is building out its ICT function, and this is one of the first senior hires in a new GRC vertical.

You’ll own governance, risk and compliance across the data centre OT and ICT estate: building management, power and cooling controls, monitoring platforms and the corporate systems that sit around them. The immediate priority is ISO 27001 alignment and certification, alongside the Australian requirements that apply to critical data centre assets, such as the SOCI Act and Essential Eight.

This is a build, not a maintenance job. There is no GRC platform in place yet, so you’ll recommend one, implement it and use it to map, monitor and report controls across the business.

Why it's worth a look

• A genuine greenfield remit: you'll shape the function, the platform and the team
• An APAC role at a business with significant capacity planned across the region
• A hiring manager with a clear, mapped team plan and further hires to follow

What you’ll do

• Set the GRC strategy, roadmap and operating model for data centre OT and ICT
• Lead ISO 27001 alignment and certification, plus the country-specific controls that go beyond it, starting with Australia
• Select and implement a GRC platform, and build the control library, testing and reporting on it
• Own the OT and ICT risk register, risk acceptance and remediation tracking
• Lead internal and external audits and customer assurance requests
• Set vendor and third-party security expectations, including remote access
• Report clearly on risk posture and control maturity to the executive team
• Lead an assistant manager and direct outsourced specialists

What they’re looking for

• Significant GRC, technology risk or assurance experience in data centres, critical infrastructure, utilities, telecoms, financial services or similar regulated environments
• Hands-on ISO 27001 implementation, ideally taking an organisation through certification
• A working knowledge of Australian requirements such as the SOCI Act and Essential Eight
• Experience building controls on a GRC platform such as ServiceNow IRM, Archer or OneTrust
• Exposure to OT, building management or industrial control environments is a strong advantage; deep SOC or security engineering experience is not the core of this role
• The ability to explain technical risk to senior, non-technical stakeholders