Senior Governance, Risk & Compliance (GRC) Analyst - WFH / Australian Client

Bricoleur Technologies; Pasig; Remote; PHP 1,200,000 - 2,000,000; Full time

Job summary

Bricoleur Technologies Pty is seeking a Senior Security GRC Analyst to drive comprehensive information security governance for global clients. You will manage security questionnaires, vendor risk assessments, and RFP responses, coordinating across departments to deliver accurate assurance evidence.

You will maintain the ISMS calendar, oversee audits, and advance GDPR, SOC 2, and ISO 27001 programs, leveraging AI tools while ensuring compliance and risk controls.

Qualifications

• 5+ years of experience in Information Security GRC, IT Risk, IT Audit, or Security Operations with ISO 27001 certification experience.
• Knowledge of ISO 27001, SOC 2 and GDPR; regulatory experience in financial services is a plus.
• Desirable certifications: ISO 27001 Lead Implementer/Auditor, CISA, CRISC, or CISM.
• Familiarity with MITRE ATT&CK, OWASP Top 10, CIS Benchmarks, and NIST frameworks is a plus.
• Experience with third-party risk management, vendor risk questionnaires, RFPs, and cross-functional coordination.
• Proficiency with AWS, M365/Entra ID, and Intune; ability to review security evidence and identify gaps.
• Ability to script in Python/SQL/PowerShell for security data analysis is a plus.
• Strong English communication and knowledge sharing mindset.

Responsibilities

• Manage client security due diligence end to end including security questionnaires, vendor risk assessments, RFPs and assurance requests.
• Coordinate cross-functional stakeholders to deliver accurate, timely responses.
• Maintain client security records covering obligations, evidence, and commitments.
• Develop a central assurance library with standard responses, evidence packs, policies, and certifications.
• Use AI tools to streamline assurance workflows while verifying outputs before use.
• Support AI governance, data sharing restrictions, and risk registers.
• Oversee ISO 27001 ISMS calendar, policies, reviews and approvals.
• Maintain information security risk register and quarterly risk reviews.
• Drive compliance in Vanta, GDPR, ISO 27001 and SOC 2 readiness milestones.
• Coordinate GDPR data subject request processes with Legal and COO.
• Coordinate audits and post-audit actions; liaise with auditors and collect evidence.
• Manage third-party security risk and ongoing monitoring.
• Support secure product development with threat modelling and security reviews.

Skills

ISO 27001 knowledge

SOC 2 familiarity

GDPR knowledge

Security certifications

MITRE ATT&CK

Vanta/Drata experience

Vendor due diligence

AWS security

Intune/M365 Entra ID

Python/SQL/PowerShell

English communication

Tools

Vanta

Drata

Secureframe

Job description

Are you looking for a supportive and collaborative workplace with great benefits and clear career development? You've come to the right place.

We are seeking a Senior Security GRC Analyst for our client, a leading SaaS provider of streamlined digital customer acquisition, identity verification, and onboarding technology to the financial services industry globally.

Qualifications & experience

• 5+ years of experience in Information Security GRC, IT Risk, IT Audit, or Security Operations, including at least one ISO 27001 certification or surveillance audit cycle.

• Knowledge of ISO 27001, with working knowledge of SOC 2 Trust Services Criteria and GDPR. Experience with financial services security regulations or client requirements is an advantage.

• Relevant certifications such as ISO 27001 Lead Implementer/Auditor, CISA, CRISC, or CISM are desirable.

• Familiarity with MITRE ATT&CK, OWASP Top 10, CIS Benchmarks, and industry security hardening standards. Knowledge of ISO 42001 or the NIST AI Risk Management Framework is a plus.

• Experience with Vanta or similar compliance automation platforms, such as Drata or Secureframe.

• Proven experience managing security questionnaires, vendor due diligence, RFP responses, and cross-functional stakeholder coordination.

• Practical understanding of AWS, Microsoft 365/Entra ID, and Intune, including reviewing security evidence, identifying gaps, and assessing vulnerability and configuration findings.

• Experience with third-party risk management, access reviews, and vulnerability remediation, including risk-based prioritization using measures such as CVSS, EPSS, and known exploitation.

• Daily experience using AI tools such as ChatGPT, Claude, or Copilot for research, drafting, analysis, and scripting, with sound judgement in validating outputs and handling sensitive data.

• Ability to write simple scripts or queries using Python, SQL, or PowerShell to analyze security data is an advantage.

• A proactive, curious mindset with a commitment to continuous learning and knowledge sharing.

• Excellent written and verbal English communication skills, with the ability to communicate clearly and professionally with clients and internal stakeholders.

Tasks & responsibilities

Core Duties

• Manage client security due diligence end to end, including security questionnaires, vendor risk assessments, RFPs, tenders, and customer assurance requests.

• Coordinate cross-functional stakeholders across different department to deliver accurate, consistent, and timely responses.

• Maintain client-specific security records covering contractual obligations, previous responses, agreed controls, supporting evidence, and outstanding commitments.

• Develop and maintain a central assurance library of standard responses, evidence packs, policies, and certifications.

• Use AI coding assistant to streamline assurance workflows, including drafting responses, matching requests to existing evidence, analyzing controls, vulnerability data, and building reusable prompts and searchable knowledge bases. Verify all outputs before external use.

• Support AI governance and acceptable use, maintaining company policies on approved tools, data-sharing restrictions, human oversight, and AI-related risks in the risk register and supplier reviews.

• Manage company's ISO 27001 Information Security Management System (ISMS), including the security calendar, policies, standards, scheduled reviews, and required approvals.

• Maintain the information security risk register, facilitate quarterly risk reviews, and track treatment plans and corrective actions through to closure.

• Drive compliance in Vanta, including administering the platform, bringing GDPR into Vanta alongside ISO 27001, and planning SOC 2 readiness against agreed milestones.

• Build and operate company's GDPR data subject request process, working with Legal and the COO, who own privacy decisions.

• Coordinate internal and external audits, including ISO 27001 surveillance audits, auditor liaison, evidence preparation, and post-audit corrective actions.

• Manage third-party security risk, including critical supplier assessments, contractual security requirements, and ongoing risk monitoring.

• Support secure product development by reviewing new features, architecture changes, and third-party integrations with Platform Engineering and DevSecOps, including threat modelling and penetration test scoping.

• Manage vulnerability remediation across cloud, endpoints, and applications by reviewing security scan results and penetration test findings, prioritizing risks based on severity and exploitability, assigning remediation actions, and tracking completion against agreed SLAs.

• Coordinate quarterly user and privileged access reviews across corporate and production systems, ensuring access records and review evidence are complete.

• Oversee managed IT service provider governance, reviewing monthly reports for SLA breaches, access issues, unapproved software, and endpoint compliance, and following up on findings.

• Monitor software licenses, SaaS usage, and costs, including Microsoft 365 and Copilot, and identify opportunities to optimize spending.

• Maintain software and asset security records, including the approved software register, deployment approvals, asset audit results, and secure device disposal evidence.

• Manage security awareness and phishing simulations, track completion and click rates, and follow up on overdue training.

• Coordinate incident response and business continuity/disaster recovery exercises, including scenario planning, documentation, and follow-up actions.

• Prepare monthly, quarterly, and annual security reports, including ISMS performance reports, management review inputs, and executive or board briefings.

• Monitor changes in security standards, regulations, and client contractual requirements, assessing their impact on company's compliance program and run vulnerability management, security posture reviews and threat intelligence.