GRC Analyst

About cybr:co

cybr:co is an Australian identity security consultancy. We help organisations get identity right, from strategy and design through to hands-on engineering, so they end up with security they can trust and own. We're a small team of senior specialists working with enterprise, financial services and government clients.

The role

As a GRC Analyst, you'll help our clients understand and manage their security risk, with a focus on identity and access. You'll run risk and compliance assessments, and work on identity governance projects alongside our specialists in Entra ID, PAM and IGA.

You'll work on cybr:co-led engagements and on longer-term assignments embedded with client teams. In both, you'll be client-facing, and we'll always be clear about what an assignment involves before it starts.

What you'll do

• Run security risk assessments, control reviews and gap analyses against frameworks such as Essential Eight, ISO 27001 and NIST CSF
• Contribute to identity governance projects: access reviews and certification campaigns, joiner-mover-leaver processes, role and entitlement design, and SoD rules
• Map identity and access controls to compliance and audit requirements, and track remediation through to closure
• Write and update security policies, standards and procedures, particularly for access management and privileged access
• Gather requirements and design processes with business and technical stakeholders on identity programs
• Turn findings into clear reporting for technical teams and leadership, and walk stakeholders through what they mean

What you'll bring

• Experience in a GRC, risk, compliance or security assurance role, typically around three to five years
• Hands-on experience assessing against frameworks such as Essential Eight, ISO 27001 or NIST CSF
• An understanding of IAM concepts such as identity lifecycle, least privilege, RBAC, privileged access and access reviews, or a strong interest in building it
• Clear written communication: reports and findings that hold up without you in the room to explain them
• Confidence presenting to clients and working with stakeholders from engineers to executives

Nice to have

• Experience on IGA or PAM projects, or exposure to platforms such as SailPoint, Saviynt, Entra ID Governance, BeyondTrust or CyberArk
• Experience with access review, certification or SoD programs, particularly in financial services or government
• Certifications such as ISO 27001 Lead Implementer or Auditor, CISA, CISM or SC-300
• Experience with ISM or PSPF assessments

Room to grow

You'll work alongside senior identity engineers and architects on real client programs, and build a specialism that few GRC professionals have. From here, you could move into identity governance, security advisory or risk leadership, and we'll support you with certifications and live work to use them on.

Why cybr:co

• Work with a team of experts who love to mentor and share knowledge.
• Build an identity specialism that sets you apart in GRC
• Variety: project engagements and embedded assignments across enterprise, financial services and government clients, with a team behind you either way
• We take the time to do the work properly and build client relationships that last.
• Hybrid working

How to apply