Senior Governance, Risk & Compliance Consultant

This is a fully remote position, open to applicants in Sri Lanka.

📋 Description

• Plan, coordinate, and execute cybersecurity readiness, gap, and maturity evaluations for both commercial and regulated clients.

• Evaluate organizations in accordance with ISO/IEC 27001, ASD Essential Eight, NIST Cybersecurity Framework 2.0, and ISO/IEC 42001.

• Assess the design, implementation, and operational effectiveness of security, governance, and risk management controls.

• Conduct interviews with stakeholders, review policies and procedures, and analyze technical evidence.

• Identify control deficiencies, governance weaknesses, compliance risks, and opportunities for enhancement.

• Generate assessment reports, executive summaries, risk heatmaps, maturity assessments, control gap analyses, and prioritized recommendations.

• Present findings and recommendations to senior executives and Board members.

• Provide guidance to clients on risk treatment options, remediation priorities, and governance enhancements.

• Create and maintain assessment templates, control testing procedures, evidence requirements, and reporting formats.

• Implement quality assurance, peer review, and independent assessment methodologies.

• Keep records of assessments, supporting evidence, and working papers.

• Collaborate with cybersecurity, infrastructure, cloud, and operations teams to corroborate findings and evidence.

• Develop remediation roadmaps and assist technical teams with governance and compliance requirements.

• Validate remediation evidence and ensure that identified gaps are addressed.

• Support ongoing governance and assurance services, periodic control reviews, risk assessments, control monitoring, and compliance reporting.

• Prepare recurring governance reports, risk dashboards, and management updates.

• Engage in governance meetings, risk committee discussions, and executive reporting.

• Conduct AI governance readiness and maturity assessments aligned with ISO/IEC 42001.

• Evaluate AI governance policies, accountability frameworks, risk assessment processes, and oversight mechanisms.

• Review data governance practices concerning classification, handling, retention, access controls, and privacy obligations.

• Assess client practices against legislative and regulatory requirements, including Australian standards.

• Participate in client discovery sessions, assessment workshops, and stakeholder interviews.

• Manage assigned assessment activities to meet agreed timelines, quality standards, and deliverables.

• Contribute to assessment scopes, delivery plans, client proposals, and enhancements to managed assurance services.

⛳️ Requirements

• Minimum of eight years of experience in Governance, Risk & Compliance, cybersecurity assurance, internal audit, technology risk, or risk consulting.

• Demonstrated experience in delivering client-facing cybersecurity risk, compliance, and maturity assessments.

• Capability to independently conduct stakeholder interviews, gather and evaluate evidence, assess controls, and document findings.

• Experience in preparing comprehensive assessment reports, executive risk summaries, and prioritized remediation suggestions.

• Strong understanding of cybersecurity governance, enterprise risk management, and compliance principles.

• Experience working collaboratively with technical engineers, cybersecurity experts, business stakeholders, and senior leadership.

• Ability to manage multiple assessment activities while ensuring high standards of accuracy and professionalism.

• Profound working knowledge of ISO/IEC 27001, including ISMS requirements, risk assessments, control evaluations, and implementation maturity.

• Proven experience in assessing organizations against the ASD Essential Eight maturity model.

• Strong understanding of NIST Cybersecurity Framework 2.0 and its implementation in risk management and organizational maturity.

• Experience in conducting control gap analyses, cybersecurity maturity assessments, and compliance readiness reviews.

• Familiarity with risk registers, inherent and residual risk, control effectiveness, and risk treatment strategies.

• Knowledge of cybersecurity governance, incident management, third-party risk, business continuity, and disaster recovery.

• Experience in AI governance, data governance, or related risk and compliance areas.

• Working knowledge of ISO/IEC 42001 or other recognized AI governance and risk management frameworks.

• Understanding of risks related to organizational AI adoption, including privacy, security, accountability, transparency, and governance.

• Knowledge of data classification, data protection controls, information lifecycle management, and privacy principles.

• Experience in developing or applying structured audit and assurance methodologies.

• Strong understanding of evidence collection, sampling, control testing, and audit working paper standards.

• Ability to differentiate between control design, implementation, and operational effectiveness.

• Experience in documenting objective findings supported by evidence.

• Understanding of assessment independence, quality assurance, and professional ethics.

• Ability to produce defensible assessment conclusions.

• Excellent written English skills.

• Strong presentation, workshop facilitation, and stakeholder engagement abilities.

• Strong analytical skills, attention to detail, and structured problem-solving capabilities.

• Sound professional judgment and ability to reach objective, evidence-based conclusions.

• High integrity, independence, and a willingness to challenge unsupported claims.

• Commercial awareness with the ability to balance security, risk, regulatory obligations, and operational realities.

• Commitment to staying updated on evolving cybersecurity frameworks, regulations, emerging risks, and AI governance requirements.

• Ownership of assessment quality, completeness, and delivery.

• Experience working with Australian organizations is preferred.

• Familiarity with APRA CPS 234, APRA CPS 230, the Security of Critical Infrastructure Act, the Australian Privacy Act 1988, and Australian Privacy Principles is desirable.

• Knowledge of SOC 2, ISO/IEC 27701, ISO 22301, and other relevant assurance frameworks is beneficial.

• Understanding of the NIST AI Risk Management Framework is advantageous.

• Experience with GRC platforms, risk registers, compliance management systems, or evidence management tools is beneficial.

• Experience in providing ongoing GRC advisory services, virtual CISO support, or continuous compliance assurance is highly regarded.

• Familiarity with Microsoft Purview, Microsoft Defender, Microsoft Entra ID, and Azure governance is an asset.

• Preferred certifications include ISO/IEC 27001 Lead Auditor, ISO/IEC 27001 Lead Implementer, CISA, CISM, CRISC, AIGP, AAIA, and ISO/IEC 42001 Lead Auditor or Lead Implementer; equivalent professional knowledge and experience may be demonstrated.

🏝️ Benefits

• Receive payment in Australian Dollars.

• Medical insurance from day one for you and your spouse (or parents if unmarried).

• Comprehensive OPD coverage for doctor visits and all your medical needs.

• Home office setup allowance.

• Internet allowance.

• Gym and wellness allowance.

• Regular team events and engagement activities.

• Diji Assist mental health and counseling support.

• Reimbursement for industry certifications.

• Open-door culture.

• Flexible work options – home or office.

• Recognition and rewards.

• Holiday celebrations and year-end parties.