Colombo, Western Province, Sri Lanka
Onsite
At least eight years of experience in Governance, Risk & Compliance, cybersecurity assurance, internal audit, technology risk, or risk consulting
Proven experience delivering client-facing cybersecurity risk, compliance, and maturity assessments
Ability to independently conduct stakeholder interviews, gather and evaluate evidence, assess controls, and document findings
Experience preparing detailed assessment reports, executive risk summaries, and prioritised remediation recommendations
Strong understanding of cybersecurity governance, enterprise risk management, and compliance principles
Experience collaborating with technical engineers, cybersecurity specialists, business stakeholders, and senior leadership
Ability to manage multiple assessment activities while maintaining high standards of accuracy and professionalism
Strong working knowledge of ISO/IEC 27001, including ISMS requirements, risk assessment, control evaluation, and implementation maturity
Demonstrated experience assessing organisations against the ASD Essential Eight maturity model
Strong understanding of NIST Cybersecurity Framework 2.0 and its application to risk management and organisational maturity
Experience conducting control gap analyses, cybersecurity maturity assessments, and compliance readiness reviews
Understanding of risk registers, inherent and residual risk, control effectiveness, and risk treatment strategies
Knowledge of cybersecurity governance, incident management, third-party risk, business continuity, and disaster recovery
Experience in AI governance, data governance, or related risk and compliance disciplines
Working knowledge of ISO/IEC 42001 or other recognised AI governance and risk management frameworks
Understanding of risks associated with organisational AI adoption, including privacy, security, accountability, transparency, and governance
Knowledge of data classification, data protection controls, information lifecycle management, and privacy principles
Ability to assess governance practices and recommend practical improvements
Experience developing or applying structured audit and assurance methodologies
Strong understanding of evidence collection, sampling, control testing, and audit working paper standards
Ability to distinguish between control design, implementation, and operating effectiveness
Experience documenting objective findings that are traceable to supporting evidence
Understanding of assessment independence, quality assurance, and professional ethics
Ability to produce defensible assessment conclusions for management and external stakeholders
Experience working with Australian organisations, particularly in regulated sectors such as financial services, healthcare, government, or critical infrastructure, is advantageous
Familiarity with APRA CPS 234, APRA CPS 230, the Security of Critical Infrastructure Act, the Australian Privacy Act 1988, and Australian Privacy Principles is desirable
Knowledge of SOC 2, ISO/IEC 27701, ISO 22301, and other relevant assurance frameworks is beneficial
Understanding of the NIST AI Risk Management Framework is advantageous
Experience with GRC platforms, risk registers, compliance management systems, or evidence management tools is beneficial
Experience providing ongoing GRC advisory services, virtual CISO support, or continuous compliance assurance is highly regarded
Familiarity with Microsoft Purview, Microsoft Defender, Microsoft Entra ID, and Azure governance is beneficial
Exceptional written English and the ability to produce polished reports for senior executives and Boards
Ability to translate complex technical and compliance matters into clear business risks and actionable recommendations
Strong presentation, workshop facilitation, and stakeholder engagement skills
Experience preparing executive summaries, risk dashboards, maturity assessments, and remediation roadmaps
Confidence communicating difficult findings constructively and professionally
Strong analytical thinking, attention to detail, and structured problem-solving abilities
Sound professional judgement and the ability to reach objective, evidence-based conclusions
Strong integrity, independence, and willingness to challenge unsupported claims
A practical consulting mindset focused on customer objectives and meaningful business outcomes
Commercial awareness and the ability to balance security, risk, regulatory obligations, and operational realities
Strong collaboration skills while maintaining accountability for independent assurance conclusions
Commitment to keeping up to date with evolving cybersecurity frameworks, regulations, emerging risks, and AI governance requirements
Ownership of assessment quality, completeness, and delivery
Candidates should ideally hold one or more of the following certifications or demonstrate equivalent professional knowledge and experience:
ISO/IEC 27001 Lead Auditor
ISO/IEC 27001 Lead Implementer
Certified Information Systems Auditor (CISA)
Certified Information Security Manager (CISM)
Certified in Risk and Information Systems Control (CRISC)
IAPP Artificial Intelligence Governance Professional (AIGP)
ISACA Advanced in AI Audit (AAIA)
ISO/IEC 42001 Lead Auditor or Lead Implementer
Additional qualifications in risk management, privacy, cybersecurity governance, or relevant regulatory frameworks will be highly regarded.
Plan, coordinate, and deliver cybersecurity readiness, gap, and maturity assessments for commercial and regulated customers
Assess organisations against recognised frameworks, including ISO/IEC 27001, ASD Essential Eight, NIST Cybersecurity Framework 2.0, and ISO/IEC 42001
Evaluate the design, implementation, and operating effectiveness of security, governance, and risk management controls
Conduct stakeholder interviews, review policies and procedures, and examine technical evidence
Assess risk management, incident response, business continuity, access management, and third-party risk processes
Identify control gaps, governance weaknesses, compliance risks, and improvement opportunities
Ensure findings are accurate, traceable, evidence-based, and defensible
Translate technical findings and control deficiencies into clearly articulated business risks and organisational impacts
Prepare comprehensive assessment reports for senior management, executive leadership teams, and Boards
Develop executive summaries, risk heatmaps, maturity assessments, control gap analyses, and prioritised recommendations
Explain cybersecurity risks in the context of business operations, regulatory obligations, financial exposure, and organisational resilience
Present findings and recommendations to customer stakeholders, including senior executives and Board representatives
Advise customers on risk treatment options, remediation priorities, and governance improvements
Contribute to the development and continuous improvement of managed assurance assessment methodologies
Develop and maintain standardised assessment templates, control testing procedures, evidence requirements, and reporting formats
Establish consistent approaches to risk scoring, maturity assessment, gap analysis, and remediation prioritisation
Maintain documented assessment criteria and evidence standards to support transparency and repeatability
Apply quality assurance, peer review, and independent assessment principles
Identify and manage potential conflicts of interest between assurance activities and technical remediation services
Maintain complete assessment records, supporting evidence, and working papers
Monitor changes to frameworks, standards, and regulatory requirements and recommend updates to assessment methodologies
Collaborate with cybersecurity, infrastructure, cloud, and operations teams to validate technical findings and supporting evidence
Assess the effectiveness of technical and administrative security controls
Translate control deficiencies into practical, prioritised remediation recommendations
Develop remediation roadmaps that account for risk severity, business impact, regulatory requirements, implementation complexity, and available resources
Help customers determine appropriate risk treatment strategies, including remediation, mitigation, acceptance, and transfer
Guide technical teams on governance and compliance requirements associated with remediation
Validate remediation evidence and confirm whether identified gaps have been appropriately addressed
Maintain appropriate separation between independent assurance and technical implementation responsibilities
Support ongoing governance and assurance services to help customers maintain and improve their compliance posture
Conduct periodic reviews of security controls, risk registers, policies, compliance obligations, and remediation progress
Help customers maintain cybersecurity governance frameworks, risk management processes, and compliance documentation
Monitor changes in organisational risk profiles, emerging threats, regulatory requirements, and control effectiveness
Support ongoing risk assessments, control monitoring, and compliance reporting
Prepare recurring governance reports, risk dashboards, and management updates
Participate in governance meetings, risk committee discussions, and executive reporting
Identify opportunities to improve risk ownership, accountability, and governance maturity
Promote continuous improvement rather than reliance solely on annual or point-in-time assessments
Assess and improve organisational governance arrangements for artificial intelligence and data management
Conduct AI governance readiness and maturity assessments aligned with ISO/IEC 42001 and relevant AI risk management principles
Evaluate AI governance policies, accountability structures, risk assessment processes, and oversight mechanisms
Identify risks associated with AI adoption, including data privacy, security, transparency, bias, third-party dependencies, and inappropriate use
Assess controls for responsible AI adoption, including risk classification, human oversight, and monitoring
Review data governance practices covering information classification, data handling, retention, access controls, and privacy obligations
Develop practical recommendations to strengthen AI and data governance
Monitor developments in AI governance standards and regulatory expectations
Assess customer security and governance practices against applicable legislative and regulatory obligations
Support compliance readiness and gap assessments for regulated Australian organisations
Evaluate requirements associated with APRA CPS 234, APRA CPS 230, the Security of Critical Infrastructure Act, and the Australian Privacy Act 1988 and Australian Privacy Principles
Explain how regulatory obligations translate into governance, security, and operational controls
Identify regulatory compliance gaps and develop risk-based improvement recommendations
Collaborate with customer stakeholders and relevant specialists to support regulatory assurance initiatives
Participate in customer discovery sessions, assessment workshops, and stakeholder interviews
Build trusted professional relationships with executives, risk owners, IT leaders, and security teams
Manage assigned assessment activities against agreed timelines, quality standards, and deliverables
Clearly communicate assessment requirements, evidence requests, findings, and recommendations
Exercise sound professional judgement when evaluating incomplete evidence, control effectiveness, and risk exposure
Contribute to assessment scopes, delivery plans, and customer proposals as required
Support the ongoing improvement of managed assurance service offerings
π° Get paid in Australian Dollars
π₯ Medical insurance from day one for you + spouse (or parents if unmarried)
π©Ί Generous OPD coverage from doctor visits to all your medical needs
π‘ Home office setup allowance to build your ideal workspace
π Internet allowance to keep you connected
πͺ Gym & wellness allowance to stay fit and balanced
π Work hard, play hard β regular team events & engagement activities
π§ Diji Assist β Mental health & counseling support when you need it
π We invest in you β reimbursement for industry certifications
π£οΈ Open-door culture β your ideas and feedback always matter
π Flexible work β home or office, wherever you do your best work
π Rewards & recognition that actually recognize you
π₯³ Great christmas & financial year-end parties to unwind with your loved ones
