Senior Security Consultant (GRC)

Decipher Bureau; Sydney; Hybrid; AUD 130,000 - 150,000; Full time

Benefits offered by this job

Flexible working

Job summary

Decipher Bureau is seeking a cyber security advisory specialist to develop enterprise strategies and risk programs for clients in Australia. The role combines hands-on technical work with high-level risk and compliance guidance, partnering with engineering and executive teams.

You will run workshops, assess architectures, and translate findings into prioritised, practical recommendations while writing security policies and standards tailored to real environments.

Qualifications

• 3+ years' experience in cyber security consulting or GRC.
• Technical foundation in software engineering, solution or architecture.
• Experience with ISO 27001, NIST CSF and the Essential Eight.

Responsibilities

• Build enterprise cyber strategies and risk programs.
• Deliver a broad mix of strategy, governance, risk and compliance engagements from scoping to final recommendations.
• Run tabletop exercises and workshops with technical teams and senior executives.
• Assess security architecture and design decisions, turning findings into practical guidance.
• Write policies, standards and control frameworks adopted by engineering teams.
• Take frameworks beyond compliance to fit client environments.

Skills

Cyber security

GRC

Strategy

Board comms

Tools

ISO 27001

NIST CSF

Essential Eight

Job description

The Company

We're partnering with a boutique Australian cyber security consultancy whose reputation is built on genuine technical depth. Their team is known for hands-on expertise that goes well beyond theory. Global brands and ambitious organisations trust them with complex, high-stakes security problems.

Their advisory practice works the same way. No box-ticking, no recycled reports. Every piece of advice is grounded in a real understanding of how systems are built, how they fail and how attackers think.

The Role

This is a role for someone who started out building things and moved into cyber security advisory. You'll deliver strategy and GRC engagements, and your technical background will make your advice credible. You'll be equally comfortable reviewing an architecture diagram with an engineering team and explaining risk to an executive committee.

What You'll Be Doing

• Building and shaping enterprise cyber strategies and risk programs, not just assessing against them.
• Delivering a broad mix of strategy, governance, risk and compliance engagements from scoping to final recommendations.
• Running tabletop exercises and workshops with technical teams and senior executives.
• Assessing security architecture and design decisions, and turning findings into practical, prioritised guidance.
• Writing policies, standards and control frameworks that engineering teams will adopt.
• Taking frameworks such as ISO 27001, NIST CSF and the Essential Eight beyond compliance and making them fit the client's real environment.

What You'll Bring

• A technical foundation, ideally in software engineering, solution or architecture, or a similar hands-on discipline.
• 3+ years' experience in cyber security consulting or GRC, with cyber strategy experience a big plus.
• Breadth across strategy and GRC engagements. If your experience is mostly repeat ISO or NIST assessments, this may not be the right fit.
• Consulting experience with a Big 4 firm, a security boutique/
• The ability to dig into technical detail and still communicate clearly at board level.
• A genuine passion for cyber strategy and risk, or for building a new capability from the ground up.

Why Join?

• Advisory work that is respected because it is technically strong.
• A small, highly capable team where your contribution is visible and valued.
• Complex, varied engagements across industries.
• Career growth and shaping the advisory practice.
• Permanent role at $130k-$150k + Super, with flexible working.

Location: Sydney-based preferred, but open to remote candidates anywhere in Australia.

Salary: $130,000 - $150,000 + Super, depending on experience.

This role is for you if

you want to change how organisations approach cyber risk, not just find your next job move. If you're energised by building, strategising and making a real impact through client work, we'd love to hear from you.