ISO 27001 Lead Implementer

Sharp Corporation of Australia Pty Limited is seeking an experienced ISO 27001 Implementation Consultant to lead the implementation of an Information Security Management System (ISMS) and support the company in achieving ISO/IEC 27001 certification.

The consultant will be responsible for assessing the company's current information security environment, identifying gaps against ISO 27001 requirements, developing an implementation plan, coordinating the implementation of required controls, and preparing the company for independent external certification audits.

The engagement is project-based, with a focus on delivering practical outcomes within an agreed timeframe. The consultant is expected to provide hands-on implementation support, coordinate activities across relevant departments and ensure the ISMS is appropriately documented, implemented and operational.

The consultant must have proven experience leading organisations through ISO 27001 implementation and certification, rather than providing advice or conducting assessments only.

A. Initial Assessment and Project Planning

• Conduct an initial assessment of the company's existing information security practices, IT environment, policies and procedures.
  

• Perform a gap analysis against the applicable requirements of ISO/IEC 27001:2022.
  

• Determine the proposed ISMS scope, taking into account the company's business operations, systems, locations, information assets and relevant interfaces with group companies and external service providers.
  

• Develop a practical implementation roadmap, including key milestones, deliverables, resource requirements, responsibilities and estimated timelines.
  

• Identify any existing group-level policies, security standards or controls that may be applicable to the Australian business.
  

B. ISMS Development and Documentation

• Establish and document the ISMS in accordance with ISO 27001 requirements.
  

• Develop or update the information security policies, procedures, standards and records required for implementation.
  

• Conduct information security risk assessments and establish a risk register and risk treatment plan.
  

• Prepare the Statement of Applicability (SoA), including the rationale for the inclusion or exclusion of applicable Annex A controls.
  

• Establish the required processes for information security objectives, performance monitoring, document control, incident management and continual improvement.
  

• Ensure the documentation reflects the company's actual operations and is practical to maintain after the project is completed.
  

C. Implementation of Information Security Controls

• Work with the company's IT team and relevant stakeholders to assess and implement required information security controls.
  

• Review controls relating to access management, information assets, data protection, supplier security, backup and recovery, incident response and business continuity.
  

• Identify deficiencies in existing controls and recommend appropriate corrective actions.
  

• Coordinate implementation activities with internal personnel and external IT service providers.
  

• Provide practical guidance on evidence required to demonstrate that the controls are implemented and operating effectively.
  

D. Employee Awareness and Business Engagement

• Develop and deliver appropriate information security awareness training for employees.
  

• Communicate relevant information security policies, procedures and responsibilities.
  

• Work with IT, HR, Finance, Operations and other relevant departments to implement the required processes and controls.
  

• Assist management in establishing clear ownership of ongoing ISMS responsibilities.
  

E. Internal Audit and Certification Preparation

• Establish an internal audit programme and coordinate the completion of the required internal audit activities.
  

• Arrange or facilitate an independent and appropriately competent internal audit where necessary.
  

• Coordinate the management review process and ensure required records are available.
  

• Identify and manage non-conformities, corrective actions and outstanding implementation gaps.
  

• Prepare the company for the Stage 1 and Stage 2 certification audits.
  

• Liaise with the selected certification body and support the company in responding to audit findings.
  

• Assist with corrective action plans and supporting evidence where required.
  

The consultant must ensure that the internal audit function is sufficiently independent from the activities being audited.

F. Handover and Ongoing Sustainability

• Provide a complete handover of ISMS documentation, registers, procedures, evidence and outstanding action items.
  

• Establish a practical schedule for ongoing risk assessments, internal audits, management reviews and surveillance audits.
  

• Train nominated internal personnel to maintain the ISMS following completion of the engagement.
  

• Provide final project reporting, including completed deliverables, outstanding risks, recommendations and ongoing compliance obligations.
  

Required Experience and Qualifications

Essential requirements

• Demonstrated experience implementing ISO/IEC 27001:2022 and establishing an operational ISMS.
  

• Proven track record of leading at least one organisation through successful ISO 27001 certification.
  

• Practical experience conducting gap analyses, risk assessments and risk treatment planning.
  

• Experience developing ISO 27001 documentation, including the Statement of Applicability, risk register, risk treatment plan and internal audit records.
  

• Experience coordinating certification audits and resolving non-conformities.
  

• Strong project management skills and the ability to deliver defined outcomes within agreed timeframes.
  

• Ability to engage effectively with IT personnel, business managers, employees and external service providers.
  

• Excellent written and verbal communication skills.
  

Desirable requirements

• ISO 27001 Lead Implementer and/or Lead Auditor qualification.
  

• Experience implementing ISO 27001 in a medium-sized business or a multinational organisation.
  

• Experience working with overseas head offices and group-level information security requirements.
  

• Knowledge of Australian privacy requirements and relevant contractual information security obligations.
  

• Experience coordinating implementation activities across internal IT teams and outsourced service providers.
  

Project Deliverables

The consultant will be required to provide, at a minimum:

1. Initial gap analysis and assessment report.
   

1. Approved ISMS scope and implementation project plan.
   

1. Information security risk assessment, risk register and risk treatment plan.
   

1. Completed Statement of Applicability.
   

1. Required ISMS policies, procedures, registers and supporting documentation.
   

1. Evidence of implementation of applicable controls and employee awareness activities.
   

1. Completed internal audit and management review records.
   

1. Certification audit readiness assessment and support for Stage 1 and Stage 2 audits.
   

1. Corrective action plans for identified non-conformities, as applicable.
   

1. Final handover package and ongoing ISMS maintenance plan.
   

The engagement will be considered successfully delivered when:

• The agreed ISMS scope and required documentation have been established.
  

• Required controls have been implemented to the extent agreed in the project plan.
  

• Risk assessments, internal audits and management reviews have been completed as required.
  

• The company is prepared for the external certification audit.
  

• The consultant has supported the company through the certification process and addressed relevant findings within the agreed scope.
  

• All documentation and responsibilities have been handed over to nominated internal personnel.
  

The ultimate objective is for the company to achieve ISO 27001 certification through an independent certification body. Certification remains subject to the certification body's assessment and decision.

Engagement and Reporting

The consultant will work under an agreed statement of work or contract setting out the project scope, milestones, deliverables, fees and estimated completion date.

The consultant will report progress regularly to the General Manager – Administration & Operations and coordinate implementation activities with relevant internal stakeholders.

The consultant must promptly report material risks, delays, resource constraints and issues that may affect the project timeline or certification outcome.

The consultant is expected to work independently, take ownership of agreed deliverables and provide practical recommendations that are appropriate to the company's size, risk profile and operating environment.