Senior Security GRC Analyst - WFH / Australian Client

Are you looking for a supportive and collaborative workplace with great benefits and clear career development? You've come to the right place.

We are seeking a Senior Security GRC Analyst for our client, a leading SaaS provider of streamlined digital customer acquisition, identity verification, and onboarding technology to the financial services industry globally.

Qualifications & experience

• 5+ years of experience in Information Security GRC, IT Risk, IT Audit, or Security Operations, including at least one ISO 27001 certification or surveillance audit cycle.

• Knowledge of ISO 27001, with working knowledge of SOC 2 Trust Services Criteria and GDPR. Experience with financial services security regulations or client requirements is an advantage.

• Relevant certifications such as ISO 27001 Lead Implementer/Auditor, CISA, CRISC, or CISM are desirable.

• Familiarity with MITRE ATT&CK, OWASP Top 10, CIS Benchmarks, and industry security hardening standards. Knowledge of ISO 42001 or the NIST AI Risk Management Framework is a plus.

• Experience with Vanta or similar compliance automation platforms, such as Drata or Secureframe.

• Proven experience managing security questionnaires, vendor due diligence, RFP responses, and cross-functional stakeholder coordination.

• Practical understanding of AWS, Microsoft 365/Entra ID, and Intune, including reviewing security evidence, identifying gaps, and assessing vulnerability and configuration findings.

• Experience with third-party risk management, access reviews, and vulnerability remediation, including risk-based prioritization using measures such as CVSS, EPSS, and known exploitation.

• Daily experience using AI tools such as ChatGPT, Claude, or Copilot for research, drafting, analysis, and scripting, with sound judgement in validating outputs and handling sensitive data.

• Ability to write simple scripts or queries using Python, SQL, or PowerShell to analyze security data is an advantage.

• A proactive, curious mindset with a commitment to continuous learning and knowledge sharing.

• Excellent written and verbal English communication skills, with the ability to communicate clearly and professionally with clients and internal stakeholders.

Tasks & responsibilities

Core Duties

• Manage client security due diligence end to end, including security questionnaires, vendor risk assessments, RFPs, tenders, and customer assurance requests.

• Coordinate cross-functional stakeholders across different department to deliver accurate, consistent, and timely responses.

• Maintain client-specific security records covering contractual obligations, previous responses, agreed controls, supporting evidence, and outstanding commitments.

• Develop and maintain a central assurance library of standard responses, evidence packs, policies, and certifications.

• Use AI coding assistant to streamline assurance workflows, including drafting responses, matching requests to existing evidence, analyzing controls, vulnerability data, and building reusable prompts and searchable knowledge bases. Verify all outputs before external use.

• Support AI governance and acceptable use, maintaining company policies on approved tools, data-sharing restrictions, human oversight, and AI-related risks in the risk register and supplier reviews.

• Manage company’s ISO 27001 Information Security Management System (ISMS), including the security calendar, policies, standards, scheduled reviews, and required approvals.

• Maintain the information security risk register, facilitate quarterly risk reviews, and track treatment plans and corrective actions through to closure.

• Drive compliance in Vanta, including administering the platform, bringing GDPR into Vanta alongside ISO 27001, and planning SOC 2 readiness against agreed milestones.

• Build and operate company’s GDPR data subject request process, working with Legal and the COO, who own privacy decisions.

• Coordinate internal and external audits, including ISO 27001 surveillance audits, auditor liaison, evidence preparation, and post-audit corrective actions.

• Manage third-party security risk, including critical supplier assessments, contractual security requirements, and ongoing risk monitoring.

• Support secure product development by reviewing new features, architecture changes, and third-party integrations with Platform Engineering and DevSecOps, including threat modelling and penetration test scoping.

• Manage vulnerability remediation across cloud, endpoints, and applications by reviewing security scan results and penetration test findings, prioritizing risks based on severity and exploitability, assigning remediation actions, and tracking completion against agreed SLAs.

• Coordinate quarterly user and privileged access reviews across corporate and production systems, ensuring access records and review evidence are complete.

• Oversee managed IT service provider governance, reviewing monthly reports for SLA breaches, access issues, unapproved software, and endpoint compliance, and following up on findings.

• Monitor software licenses, SaaS usage, and costs, including Microsoft 365 and Copilot, and identify opportunities to optimize spending.

• Maintain software and asset security records, including the approved software register, deployment approvals, asset audit results, and secure device disposal evidence.

• Manage security awareness and phishing simulations, track completion and click rates, and follow up on overdue training.

• Coordinate incident response and business continuity/disaster recovery exercises, including scenario planning, documentation, and follow-up actions.

• Prepare monthly, quarterly, and annual security reports, including ISMS performance reports, management review inputs, and executive or board briefings.

• Monitor changes in security standards, regulations, and client contractual requirements, assessing their impact on company’s compliance program and run vulnerability management, security posture reviews and threat intelligence.