ISMS & GRC Lead — ISO 27001, Risk & Assurance

Luxury Escapes; Sydney; On-site; AUD 180,000 - 260,000; Full time

Benefits offered by this job

20% discount on Luxury Holidays

Breakfast and lunch provided 5-days a週

Health and Well-being programs

Annual Hackathons

Half-day birthday bonus leave

Collaborative team culture

Job summary

Luxury Escapes is seeking its first dedicated information security lead to own the ISMS and certification programme, coordinating audits and ongoing assurance with executives, Engineering, IT and our external Data Protection Officer.

You will set direction, maintain risk and compliance frameworks, and help teams understand their responsibilities while coordinating incidents and security awareness initiatives.

Qualifications

• Experience running a management system or assurance programme, including evidence and auditor engagement.
• Practical information security risk management skills and the ability to build clear ownership across teams.
• Working knowledge of PCI DSS and GDPR or comparable privacy obligations.
• Experience with third-party security risk and customer assurance requests.
• Strong planning, stakeholder management and communication skills, with sound judgement on proportionate controls.
• Experience in e-commerce, travel, payments or another high-volume consumer environment.
• Familiarity with AWS, cloud security, SOC 2, AI governance or ISO 42001.
• Working knowledge of security tools and reports, such as EDR, vulnerability management, firewalls, SIEM, Microsoft Entra ID or SaaS access management.
• Experience working across jurisdictions and distributed teams.

Responsibilities

• Own the ISMS and certification programme, coordinating its certification and ongoing assurance.
• Maintain the ISMS scope, Statement of Applicability, policies and supporting evidence.
• Support the Stage 1 and Stage 2 ISO 27001 audits; coordinate internal and external audits, findings and corrective actions.
• Lead management reviews and report ISMS performance to the ISMS Governance Council.
• Own the risk method, register and treatment tracking, and facilitate assessments with risk owners.
• Coordinate recurring assurance, including access reviews, control testing, evidence collection and penetration tests.
• Monitor control performance and communicate key exposures, findings and remediation progress.
• Coordinate security and privacy assessments for business systems; maintain the systems inventory.
• Manage vendor and sub-processor security assessments, including onboarding and periodic reviews.
• Support ISO 27001, PCI DSS and privacy compliance, working with the Data Protection Officer on specialist advice.
• Track emerging obligations, including the EU Artificial Intelligence Act, and drive improvements to controls and processes.
• Maintain the incident response plan, coordinate incidents and track follow-up actions.
• Run security awareness and training, and respond to customer questionnaires and due diligence requests.
• Coordinate security projects across teams to keep actions on track.

Skills

ISMS management

Risk management

PCI DSS / GDPR

Third-party risk

Stakeholder management

E-commerce security

Cloud security

SOC 2 / ISO 27001

EDR / SIEM

Cross-jurisdiction teams

Education

CISM, CISSP, ISO 27001 Lead Implementer/Lead Auditor

Tools

AWS

Cloud security

SOC 2

AI governance

ISO 42001

Job description

Luxury Escapes is seeking its first dedicated information security lead to own the ISMS and certification programme, coordinating audits and ongoing assurance with executives, Engineering, IT and our external Data Protection Officer.

You will set direction, maintain risk and compliance frameworks, and help teams understand their responsibilities while coordinating incidents and security awareness initiatives.