Cyber GRC Manager — Risk, Compliance & Privacy

DEFEND Limited; Auckland; Hybrid; NZD 120,000 - 180,000; Full time

Benefits offered by this job

KiwiSaver 3.5%

Health Insurance

Mobile & Broadband discounts

Flexible, hybrid work

Home office setup allowance

Employee wellbeing support

Job summary

DEFEND Limited in Auckland is seeking a GRC Manager to lead governance, risk, compliance, security and privacy capabilities, shaping strategy with senior stakeholders.

You will embed risk into decision making, manage audits and certifications, and strengthen security posture through policy development and data governance. The role reports to executive leadership and influences the cybersecurity roadmap.

Qualifications

• Proven experience in Governance, Risk and Compliance (GRC) and related disciplines.
• Knowledge of ISO 27001, SOC 2, NIST, COSO, GDPR, and other regulatory requirements.
• Experience developing and improving risk management and compliance frameworks.
• Experience leading external audits, certifications and assurance activities.
• Strong ability to translate complex risk into practical business solutions.

Responsibilities

• Manage DEFEND's GRC capability by leading and improving governance, risk, compliance, security and privacy frameworks.
• Maintain trust through ISO certifications, SOC 2 attestations and other obligations.
• Embed risk into decision making by partnering with leaders to integrate risk management.
• Lead enterprise risk activities including customer, supplier, project, software and privacy risk assessments.
• Strengthen security posture via policy development, control uplift and data governance.
• Support strategic outcomes and advise on key security, privacy and risk decisions.
• Provide trusted executive reporting to the ELT, Board and governance forums.

Skills

GRC

Info security

Privacy

Audits

Governance

Risk management

Stakeholder comms

Project management

Incident response

Continuous improvement

Job description

DEFEND Limited in Auckland is seeking a GRC Manager to lead governance, risk, compliance, security and privacy capabilities, shaping strategy with senior stakeholders.

You will embed risk into decision making, manage audits and certifications, and strengthen security posture through policy development and data governance. The role reports to executive leadership and influences the cybersecurity roadmap.