Senior Governance, Risk & Compliance Consultant

Dijital Team

. Plan, coordinate, and deliver cybersecurity readiness, gap, and maturity assessments for commercial and regulated customers .

Posted 10/19/2026full-timeRemote • Sri LankaSeniorWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates extensive expertise in Governance, Risk & Compliance, with a strong focus on cybersecurity assessments, compliance frameworks, and risk management strategies. Proficient in conducting detailed evaluations against ISO/IEC standards and NIST frameworks, while effectively communicating findings to senior stakeholders.

Highest-signal resume keywords

Governance, Risk & ComplianceISO/IEC 27001 AssessmentNIST Cybersecurity Framework 2.0Cybersecurity Maturity AssessmentsAI Governance

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Cybersecurity AssessmentsControl Gap AnalysisRisk Treatment StrategiesEvidence CollectionControl TestingData GovernanceIncident ManagementAudit MethodologiesCompliance Readiness ReviewsRisk Management

Soft Skills

Stakeholder EngagementAnalytical ThinkingAttention to DetailProblem-SolvingProfessional Judgement

Tools & Technologies

GRC PlatformsCompliance Management SystemsEvidence Management ToolsMicrosoft PurviewMicrosoft DefenderMicrosoft Entra IDAzure Governance

Certifications & Qualifications

ISO/IEC 27001 Lead AuditorISO/IEC 27001 Lead ImplementerCISACISMCRISCAIGPAAIAISO/IEC 42001 Lead AuditorISO/IEC 42001 Lead Implementer

Industry Keywords

ISO/IEC 27001ASD Essential EightNIST Cybersecurity FrameworkAPRA CPS 234APRA CPS 230Security of Critical Infrastructure ActAustralian Privacy Act 1988Australian Privacy PrinciplesSOC 2ISO/IEC 27701

Tech Stack

Tools & technologies

AzureCloudCyber Security

About the role

Key responsibilities & impact

Plan, coordinate, and deliver cybersecurity readiness, gap, and maturity assessments for commercial and regulated customers
Assess organisations against ISO/IEC 27001, ASD Essential Eight, NIST Cybersecurity Framework 2.0, and ISO/IEC 42001
Evaluate the design, implementation, and operating effectiveness of security, governance, and risk management controls
Conduct stakeholder interviews, review policies and procedures, and examine technical evidence
Identify control gaps, governance weaknesses, compliance risks, and improvement opportunities
Prepare assessment reports, executive summaries, risk heatmaps, maturity assessments, control gap analyses, and prioritised recommendations
Present findings and recommendations to senior executives and Board representatives
Advise customers on risk treatment options, remediation priorities, and governance improvements
Develop and maintain assessment templates, control testing procedures, evidence requirements, and reporting formats
Apply quality assurance, peer review, and independent assessment principles
Maintain assessment records, supporting evidence, and working papers
Collaborate with cybersecurity, infrastructure, cloud, and operations teams to validate findings and evidence
Develop remediation roadmaps and guide technical teams on governance and compliance requirements
Validate remediation evidence and confirm identified gaps are addressed
Support ongoing governance and assurance services, periodic control reviews, risk assessments, control monitoring, and compliance reporting
Prepare recurring governance reports, risk dashboards, and management updates
Participate in governance meetings, risk committee discussions, and executive reporting
Conduct AI governance readiness and maturity assessments aligned with ISO/IEC 42001
Evaluate AI governance policies, accountability structures, risk assessment processes, and oversight mechanisms
Review data governance practices covering classification, handling, retention, access controls, and privacy obligations
Assess customer practices against legislative and regulatory obligations, including Australian requirements
Participate in customer discovery sessions, assessment workshops, and stakeholder interviews
Manage assigned assessment activities against agreed timelines, quality standards, and deliverables
Contribute to assessment scopes, delivery plans, customer proposals, and managed assurance service improvements

Requirements

What you’ll need

At least eight years of experience in Governance, Risk & Compliance, cybersecurity assurance, internal audit, technology risk, or risk consulting
Proven experience delivering client-facing cybersecurity risk, compliance, and maturity assessments
Ability to independently conduct stakeholder interviews, gather and evaluate evidence, assess controls, and document findings
Experience preparing detailed assessment reports, executive risk summaries, and prioritised remediation recommendations
Strong understanding of cybersecurity governance, enterprise risk management, and compliance principles
Experience collaborating with technical engineers, cybersecurity specialists, business stakeholders, and senior leadership
Ability to manage multiple assessment activities while maintaining high standards of accuracy and professionalism
Strong working knowledge of ISO/IEC 27001, including ISMS requirements, risk assessment, control evaluation, and implementation maturity
Demonstrated experience assessing organisations against the ASD Essential Eight maturity model
Strong understanding of NIST Cybersecurity Framework 2.0 and its application to risk management and organisational maturity
Experience conducting control gap analyses, cybersecurity maturity assessments, and compliance readiness reviews
Understanding of risk registers, inherent and residual risk, control effectiveness, and risk treatment strategies
Knowledge of cybersecurity governance, incident management, third-party risk, business continuity, and disaster recovery
Experience in AI governance, data governance, or related risk and compliance disciplines
Working knowledge of ISO/IEC 42001 or other recognised AI governance and risk management frameworks
Understanding of risks associated with organisational AI adoption, including privacy, security, accountability, transparency, and governance
Knowledge of data classification, data protection controls, information lifecycle management, and privacy principles
Experience developing or applying structured audit and assurance methodologies
Strong understanding of evidence collection, sampling, control testing, and audit working paper standards
Ability to distinguish between control design, implementation, and operating effectiveness
Experience documenting objective findings traceable to supporting evidence
Understanding of assessment independence, quality assurance, and professional ethics
Ability to produce defensible assessment conclusions
Exceptional written English
Strong presentation, workshop facilitation, and stakeholder engagement skills
Strong analytical thinking, attention to detail, and structured problem-solving abilities
Sound professional judgement and ability to reach objective, evidence-based conclusions
Strong integrity, independence, and willingness to challenge unsupported claims
Commercial awareness and ability to balance security, risk, regulatory obligations, and operational realities
Commitment to keeping up to date with evolving cybersecurity frameworks, regulations, emerging risks, and AI governance requirements
Ownership of assessment quality, completeness, and delivery
Experience working with Australian organisations is advantageous
Familiarity with APRA CPS 234, APRA CPS 230, the Security of Critical Infrastructure Act, the Australian Privacy Act 1988, and Australian Privacy Principles is desirable
Knowledge of SOC 2, ISO/IEC 27701, ISO 22301, and other relevant assurance frameworks is beneficial
Understanding of the NIST AI Risk Management Framework is advantageous
Experience with GRC platforms, risk registers, compliance management systems, or evidence management tools is beneficial
Experience providing ongoing GRC advisory services, virtual CISO support, or continuous compliance assurance is highly regarded
Familiarity with Microsoft Purview, Microsoft Defender, Microsoft Entra ID, and Azure governance is beneficial
Preferred certifications include ISO/IEC 27001 Lead Auditor, ISO/IEC 27001 Lead Implementer, CISA, CISM, CRISC, AIGP, AAIA, and ISO/IEC 42001 Lead Auditor or Lead Implementer; equivalent professional knowledge and experience may be demonstrated

Benefits

Comp & perks

Get paid in Australian Dollars
Medical insurance from day one for you + spouse (or parents if unmarried)
Generous OPD coverage from doctor visits to all your medical needs
Home office setup allowance
Internet allowance
Gym & wellness allowance
Regular team events and engagement activities
Diji Assist mental health and counseling support
Reimbursement for industry certifications
Open-door culture
Flexible work – home or office
Rewards and recognition
Christmas and financial year-end parties