Cyber GRC Lead (OT)

Want to run an ISO 27001 ISMS yourself instead of advising on someone else’s? Fuel terminals, OT, SOCI. $185-195k base, Brisbane.

• Own the ISMS day to day
• IT and OT across fuel terminals
• Perm, Hybrid, QLD

Cyber GRC Lead | Brisbane | Hybrid | $185-195k base | Permanent

Hey there, GRC folks. Been auditing ISMSs for years and want one to call your own? Keen to work across IT and OT in a SOCI-regulated business? Want a role where you’re expected to hold your own in architecture reviews, not just update the risk register? Read on.

Before the detail, here’s what’s in it for you in this permanent role:

• $185-195k base salary
• Extra paid parental leave
• Fuel discount for you and your family
• Salary packaging and discounted private health insurance
• Tenure bonuses, plus travel and employee discount programs
• EAP for you and your immediate family, and annual flu vaccinations
• An annual family fun day, with activities for the whole family

So, who are they and why does this role exist?

You’ll be joining a privately owned national business with 40+ years behind it and 450+ staff. They’re on track to 4x revenue over the next five years, and recent private equity investment has put governance maturity and cyber firmly on the agenda. That’s where you come in.

The environment includes SOCI-regulated critical infrastructure with OT, a team of around 50 in ICT, and in-house built business platforms.

What you’ll be doing

You’ll sit in a small second-line Information Security team, reporting to the Head of Information Security. Your job is to set the standard and assure delivery, while Operations, Engineering and OT own implementation and remediation. You’ll work alongside an internal security analyst and an external MSSP-run SOC.

The ISMS currently covers the terminal operation, and part of your role is extending certification across the wider ICT estate. Day to day, think along the lines of:

• Running the ISO 27001 ISMS: internal audit schedule, management reviews, Statement of Applicability, policy suite and the security management committee
• Mapping the ISMS to Essential Eight and CIS Controls for IT, and IEC 62443 for OT, so maturity can be measured and reported
• Owning the technology risk register, risk assessments, and remediation and exception tracking
• Supporting SOCI and CIRMP compliance, and staying across Privacy Act and OAIC obligations with Legal and Procurement
• Overseeing vulnerability management across IT and OT, including remediation SLAs
• Running third-party and supplier risk assessments against the critical supplier population
• Holding the MSSP, pentesters and other security partners to measurable outcomes
• Helping build OT security governance with the OT team
• Supporting awareness training, phishing simulations, tabletop exercises and post-incident reviews

It’s worth knowing up front: the role is based just outside the city with 3-4 days in the office and 1-2 from home each week. No direct reports, but plenty of influence across the business.

What you’ll need

This one suits someone with solid GRC foundations and real technical depth, who wants to own a program rather than hand over a report and move on. You’ll likely bring:

• 5+ years in information security governance, risk and compliance, ideally in critical infrastructure, energy, utilities or financial services
• Hands-on experience operating an ISO 27001 ISMS, including internal audit, management review and the SoA
• Experience implementing or measuring against Essential Eight, CIS Controls, NIST, PCI-DSS or IEC 62443
• Risk register management and reporting to management or board level
• Enough technical depth to contribute in architecture reviews and change advisory
• Certs like CISSP, CISM, CRISC or CISA, with ISO 27001 Lead Implementer or Lead Auditor highly regarded
• Full working rights in Australia, No sponsorship.

Bonus points for:

• OT, SCADA or industrial control system exposure
• Working knowledge of SOCI / CIRMP
• Microsoft security tools like Entra, Purview and Defender
• Vulnerability management tools like Tenable, Qualys or Rapid7

If this sounds like your kind of role, consider applying. There’s more detail on the business, the environment and the team that can be shared confidentially, which might help you decide whether it’s the right fit.

Click APPLY or contact Kris on 0452 564 644 or kris@decipherbureau.com for a confidential, informal chat.

Decipher Bureau and the clients we partner with are committed to creating a diverse environment and are proud to be equal opportunity employers. All qualified applicants will be considered for employment without attention to race, colour, religion, sex, sexual orientation, gender identity, national origin, veteran, or disability status.