Cyber GRC Lead

About Cyber Forte Cyber Forte is an Australian cybersecurity and compliance consultancy helping organisations improve their security posture, achieve and maintain compliance, and prepare for independent certification and assurance.
We work with organisations across a range of industries on frameworks and standards including  ISO/IEC 27001, SOC 2, Essential Eight, ISM, PCI DSS  and broader cybersecurity governance and risk requirements.
We are looking for an experienced  GRC Lead  to join our growing delivery team and take responsibility for delivering high-quality governance, risk and compliance engagements for our clients.

About the Role As a GRC Lead, you will work directly with clients to assess their current security and compliance maturity, identify gaps, develop practical remediation plans and support them through implementation and certification/assessment activities.
You will be involved across the full engagement lifecycle — from initial discovery and gap assessments through to policy and control development, evidence collection, remediation tracking, internal audits and certification readiness.
This is a  client-facing, hands-on consulting role . We are looking for someone who can work independently, communicate confidently with stakeholders and translate compliance requirements into practical security outcomes.

Key Responsibilities Governance, Risk & Compliance  Conduct security and compliance gap assessments against ISO 27001, SOC 2 and other relevant frameworks.
Develop and maintain Statements of Applicability, control mappings, risk treatment plans and compliance roadmaps.
Review client policies, procedures, standards and supporting documentation.
Identify control gaps and provide practical, risk-based recommendations.
Support clients with remediation planning and tracking.
Perform information security risk assessments and support clients in developing and maintaining risk registers.
Assist clients in preparing evidence and maintaining audit readiness.
Conduct internal audits and control effectiveness assessments.
Support clients through certification and external audit activities.
Monitor changes to applicable standards, regulations and security requirements.
ISO 27001  Conduct ISO/IEC 27001:2022 gap assessments.
Assist with ISMS implementation and ongoing improvement.
Develop and review ISO 27001 policies, procedures and supporting documentation.
Support risk assessment and risk treatment activities.
Develop and maintain Statements of Applicability.
Support internal audit and management review activities.
Prepare clients for Stage 1 and Stage 2 certification audits.
Support surveillance and recertification activities.
Essential Eight  Conduct Essential Eight maturity assessments.
Assess client environments against ML1, ML2 and ML3 requirements.
Identify technical and governance gaps.
Develop remediation roadmaps.
Work with technical teams to validate evidence and control implementation.
Support clients preparing for Essential Eight assessments and related security requirements.
Client & Project Management  Lead client workshops and stakeholder meetings.
Gather and analyse technical and business information.
Translate technical security issues into clear business and risk language.
Maintain project actions, risks, issues and deliverables.
Manage multiple client engagements concurrently.
Prepare high-quality assessment reports, remediation plans and executive summaries.
Work closely with Cyber Forte's senior consultants and leadership team.
Ensure engagements are delivered on time, within scope and to a consistently high standard.
What We're Looking For We are looking for someone who combines  strong GRC knowledge with practical consulting experience .
Essential  3+ years' experience in cybersecurity,…