" \u003cdiv class=\"ja-job-details\"\u003e \u003ch2 class=\"title\"\u003eCyber GRC Lead | Brisbane | $185-195k base | Permanent\u003c/h2\u003e \u003cdiv class=\"meta\"\u003e \u003cul class=\"classifications\"\u003e \u003cli data-id=\"14076\"\u003e IT Security \u003c/li\u003e \u003cli data-id=\"14077\"\u003e Permanent / Full Time \u003c/li\u003e \u003cli data-id=\"14078\"\u003e Brisbane \u003c/li\u003e \u003c/ul\u003e \u003cp class=\"date-posted\"\u003e 4/11/2026 \u003c/p\u003e \u003c/div\u003e \u003cul class=\"bullet-points\"\u003e \u003cli\u003eOwn the ISMS day to day\u003c/li\u003e \u003cli\u003eIT and OT across fuel terminals\u003c/li\u003e \u003cli\u003ePerm, Hybrid, QLD\u003c/li\u003e \u003c/ul\u003e \u003cdiv class=\"description\"\u003e Hey there, GRC folks. Been auditing ISMSs for years and want one to call your own? Keen to work across IT and OT in a SOCI-regulated business? Want a role where you\u0026rsquo;re expected to hold your own in architecture reviews, not just update the risk register? Read on.\u003cbr\u003e \u0026nbsp;\u0026nbsp;\u003cbr\u003e \u003cstrong\u003eBefore the detail, here\u0026rsquo;s what\u0026rsquo;s in it for you in this permanent role:\u003c/strong\u003e\u003cbr\u003e \u003cul\u003e \u003cli\u003e$185-195k base salary\u003c/li\u003e \u003cli\u003eExtra paid parental leave\u003c/li\u003e \u003cli\u003eFuel discount for you and your family\u003c/li\u003e \u003cli\u003eSalary packaging and discounted private health insurance\u003c/li\u003e \u003cli\u003eTenure bonuses, plus travel and employee discount programs\u003c/li\u003e \u003cli\u003eEAP for you and your immediate family, and annual flu vaccinations\u003c/li\u003e \u003cli\u003eAn annual family fun day, with activities for the whole family\u003c/li\u003e \u003c/ul\u003e \u0026nbsp;\u0026nbsp;\u003cbr\u003e \u003cstrong\u003eSo, who are they and why does this role exist?\u003c/strong\u003e\u003cbr\u003e \u0026nbsp;\u0026nbsp;\u003cbr\u003e You\u0026rsquo;ll be joining a privately owned national business with 40+ years behind it and 450+ staff. They\u0026rsquo;re on track to 4x revenue over the next five years, and recent private equity investment has put governance maturity and cyber firmly on the agenda. That\u0026rsquo;s where you come in.\u003cbr\u003e The environment includes SOCI-regulated critical infrastructure with OT, a team of around 50 in ICT, and in-house built business platforms.\u003cbr\u003e \u0026nbsp;\u0026nbsp;\u003cbr\u003e \u003cstrong\u003eWhat you\u0026rsquo;ll be doing\u003c/strong\u003e\u003cbr\u003e \u0026nbsp;\u0026nbsp;\u003cbr\u003e You\u0026rsquo;ll sit in a small second-line Information Security team, reporting to the Head of Information Security. Your job is to set the standard and assure delivery, while Operations, Engineering and OT own implementation and remediation. You\u0026rsquo;ll work alongside an internal security analyst and an external MSSP-run SOC.\u003cbr\u003e \u0026nbsp;\u0026nbsp;\u003cbr\u003e The ISMS currently covers the terminal operation, and part of your role is extending certification across the wider ICT estate. Day to day, think along the lines of:\u003cbr\u003e \u003cul\u003e \u003cli\u003eRunning the ISO 27001 ISMS: internal audit schedule, management reviews, Statement of Applicability, policy suite and the security management committee\u003c/li\u003e \u003cli\u003eMapping the ISMS to Essential Eight and CIS Controls for IT, and IEC 62443 for OT, so maturity can be measured and reported\u003c/li\u003e \u003cli\u003eOwning the technology risk register, risk assessments, and remediation and exception tracking\u003c/li\u003e \u003cli\u003eSupporting SOCI and CIRMP compliance, and staying across Privacy Act and OAIC obligations with Legal and Procurement\u003c/li\u003e \u003cli\u003eOverseeing vulnerability management across IT and OT, including remediation SLAs\u003c/li\u003e \u003cli\u003eRunning third-party and supplier risk assessments against the critical supplier population\u003c/li\u003e \u003cli\u003eHolding the MSSP, pentesters and other security partners to measurable outcomes\u003c/li\u003e \u003cli\u003eHelping build OT security governance with the OT team\u003c/li\u003e \u003cli\u003eSupporting awareness training, phishing simulations, tabletop exercises and post-incident reviews\u003c/li\u003e \u003c/ul\u003e \u0026nbsp;\u0026nbsp;\u003cbr\u003e It\u0026rsquo;s worth knowing up front: the role is based just outside the city with 3-4 days in the office and 1-2 from home each week. No direct reports, but plenty of influence across the business.\u003cbr\u003e \u0026nbsp;\u0026nbsp;\u003cbr\u003e \u003cstrong\u003eWhat you\u0026rsquo;ll need\u003c/strong\u003e\u003cbr\u003e \u0026nbsp;\u0026nbsp;\u003cbr\u003e This one suits someone with solid GRC foundations and real technical depth, who wants to own a program rather than hand over a report and move on. You\u0026rsquo;ll likely bring:\u003cbr\u003e \u003cul\u003e \u003cli\u003e5+ years in information security governance, risk and compliance, ideally in critical infrastructure, energy, utilities or financial services\u003c/li\u003e \u003cli\u003eHands-on experience operating an ISO 27001 ISMS, including internal audit, management review and the SoA\u003c/li\u003e \u003cli\u003eExperience implementing or measuring against Essential Eight, CIS Controls, NIST, PCI-DSS or IEC 62443\u003c/li\u003e \u003cli\u003eRisk register management and reporting to management or board level\u003c/li\u003e \u003cli\u003eEnough technical depth to contribute in architecture reviews and change advisory\u003c/li\u003e \u003cli\u003eCerts like CISSP, CISM, CRISC or CISA, with ISO 27001 Lead Implementer or Lead Auditor highly regarded\u003c/li\u003e \u003cli\u003eFull working rights in Australia, No sponsorship.\u003c/li\u003e \u003c/ul\u003e \u0026nbsp;\u0026nbsp;\u003cbr\u003e \u003cstrong\u003eBonus points for:\u003c/strong\u003e\u003cbr\u003e \u0026nbsp;\u0026nbsp;\u003cbr\u003e \u003cul\u003e \u003cli\u003eOT, SCADA or industrial control system exposure\u003c/li\u003e \u003cli\u003eWorking knowledge of SOCI / CIRMP\u003c/li\u003e \u003cli\u003eMicrosoft security tools like Entra, Purview and Defender\u003c/li\u003e \u003cli\u003eVulnerability management tools like Tenable, Qualys or Rapid7\u003c/li\u003e \u003c/ul\u003e \u0026nbsp;\u0026nbsp;\u003cbr\u003e If this sounds like your kind of role, consider applying. There\u0026rsquo;s more detail on the business, the environment and the team that can be shared confidentially, which might help you decide whether it\u0026rsquo;s the right fit.\u003cbr\u003e \u0026nbsp;\u0026nbsp;\u003cbr\u003e Click APPLY or contact Kris on 0452 564 644 or kris@decipherbureau.com for a confidential, informal chat.\u003cbr\u003e \u0026nbsp;\u0026nbsp;\u003cbr\u003e \u003cem\u003eDecipher Bureau and the clients we partner with are committed to creating a diverse environment and are proud to be equal opportunity employers. All qualified applicants will be considered for employment without attention to race, colour, religion, sex, sexual orientation, gender identity, national origin, veteran, or disability status.\u003c/em\u003e\u003cbr\u003e \u003c/div\u003e \u003cdiv class=\"apply\"\u003e \u003ca class=\"back-link\" href=\"#\" title=\"Back to search results\"\u003eBack to search results\u003c/a\u003e \u003cinput type=\"button\" class=\"ja-button\" data-job-id=\"4483671\" value=\"Apply Now\" title=\"Apply Now\" /\u003e \u003c/div\u003e \u003c/div\u003e "