Senior GRC Analyst

About The Role

Talenza are partnering with a Brisbane-based organisation in the financial services sector to recruit a Senior Information Security GRC Analyst for an initial 6-month contract.

This role is heavily involved in controls testing and framework maturity, third-party risk management, technical risk assessments with engineering stakeholders, and audit coordination (internal and external). You'll also support the organisation's ISMS aligned to NIST, helping embed risk into technology decision-making in a practical, delivery-friendly way.

Benefits

• Initial 6 month day rate contract
• Hybrid working (3 days on-site per week)
• Fast-paced, collaborative and social environment
• Work with a mature Cyber GRC function and strong internal stakeholders

Skills (Requirements)

• Strong Cyber GRC background with proven delivery across governance, risk and compliance outcomes
• At least 5 years' experience as a GRC Analyst or 2 years as a Senior GRC Analyst
• Controls testing uplift experience and ability to improve framework maturity
• Third-party / vendor risk management experience
• Strong technical risk assessment capability with stakeholders across cloud, architecture and security controls
• Internal and external audit coordination experience (evidence, findings, remediation tracking)
• Experience supporting an ISMS and policy uplift (NIST-aligned approach preferred)

You will be responsible for:

• Enhancing and maintaining security governance, controls testing and risk management frameworks.
• Managing third-party security risk, including vendor due diligence and ongoing assessments.
• Conducting security and compliance assessments across systems, processes and technologies.
• Monitoring key risk indicators and producing governance, risk and compliance reporting for management.
• Supporting the development and maintenance of technology risk registers and business impact assessments.
• Providing security risk and controls guidance to technology and broader business teams.
• Supporting internal and external audits and responding to regulatory requirements.
• Maintaining awareness of emerging security risks, regulatory changes and industry trends.
• Building strong stakeholder relationships and promoting a positive security and risk culture across the organisation.