ISO 27001 GRC Lead: Cyber Governance & Risk Champion

CityFM; Melbourne; On-site; AUD 180,000 - 240,000; Full time

Job summary

CityFM is seeking a Cyber GRC Lead to drive ISO/IEC 27001 certification and build a robust Information Security Management System across the organisation. Reporting to the GM - Infrastructure & Security, you will coordinate risk assessments, gap analyses and control design with Technology, Quality and business units.

You will lead certification readiness, audits, and ongoing improvement of information security policies, privacy obligations and third‑party risk programs, while partnering with

Qualifications

• Bachelors in information security or related field.
• 5+ years in cyber security governance, risk & compliance or information security management.
• Experience leading ISO/IEC 27001 certification programs.
• Hands-on ISMS establishment and ongoing improvements.

Responsibilities

• Lead end-to-end ISO/IEC 27001 certification program.
• Coordinate gap assessments, risk assessments and SoA development.
• Manage certification readiness activities, internal and external audits.
• Maintain certification roadmaps, evidence repositories and readiness reporting.
• Drive accountability across information asset owners and control owners.
• Develop and review security policies, standards and procedures.
• Ensure alignment with ISO 27001, privacy obligations and contractual requirements.
• Maintain cyber risk registers and oversee risk treatment activities.
• Facilitate cyber risk assessments across systems, projects and processes.

Skills

Stakeholder engagement

Communication

Influencing skills

Cyber risk management

Education

Bachelor's degree in Information Security, Risk Management or related discipline

ISO/IEC 27001 Lead Implementer

CISSP/CRISC/CISA or similar certifications

Job description

CityFM is seeking a Cyber GRC Lead to drive ISO/IEC 27001 certification and build a robust Information Security Management System across the organisation. Reporting to the GM - Infrastructure & Security, you will coordinate risk assessments, gap analyses and control design with Technology, Quality and business units.

You will lead certification readiness, audits, and ongoing improvement of information security policies, privacy obligations and third‑party risk programs, while partnering with