Leads governance and maturity for non-OS vulnerability management across application and platform environments. Responsibilities include defining policies and standards, managing exceptions and risk acceptance, assessing residual risk, developing treatment strategies, overseeing tooling and automation, integrating security into the SDLC, and reporting risk insights to leadership. The role collaborates across cyber, application, infrastructure, and operations teams while ensuring alignment with regulatory, audit, and enterprise security requirements.
Role Summary
We are seeking an
experienced GRC Consultant – Cyber Lead to drive governance and maturity
of non-OS vulnerability management across enterprise application and
platform environments.
This role focuses on cyber
risk oversight, exception management, and vulnerability treatment strategy,
ensuring risks are effectively assessed, governed, and aligned with enterprise
security standards—while remediation execution remains with delivery teams.
Key Responsibilities
Governance & Risk Oversight
- Define and implement non-OS vulnerability management frameworks,
policies, and standards
- Establish governance forums, escalation paths, and
decision-making processes
- Ensure compliance with regulatory, audit, and enterprise
security requirements
Exception & Treatment Management
- Manage remediation exceptions and risk acceptance lifecycle
- Validate compensating controls and residual risks
- Drive risk-based treatment plans with application and
platform teams
Cyber Risk Management
- Perform risk assessments for vulnerabilities that cannot be
remediated
- Enable risk-based decision-making aligned to business risk
appetite
- Ensure proper documentation, tracking, and periodic review of
accepted risks
Tooling & Capability Uplift
- Lead tooling strategy, evaluation, and automation initiatives
- Improve vulnerability management maturity and processes
- Support training and adoption across delivery teams
Security Improvement & SDLC Integration
- Oversee remediation outcomes from pen tests, audits, and
assessments
- Promote secure-by-design and DevSecOps practices
- Ensure vulnerabilities are identified and treated before
production release
Stakeholder Management
- Collaborate with Cyber, Application, Infrastructure, and
Operations teams
- Provide risk insights to senior leadership and governance forums
- Influence prioritization based on risk severity and business
impact
Required Skills & Experience
- Strong background in GRC, cyber risk, and vulnerability
management
- Experience with application/platform vulnerabilities (non-OS)
- Knowledge of frameworks: ISO 27001, NIST, CIS
- Hands-on exposure to tools like Qualys, Tenable, Snyk, or
similar
- Expertise in risk assessment, exception management, and
compliance
- Strong stakeholder engagement and communication skills
- Familiarity with DevSecOps / SDLC security practices
Qualifications
- Bachelor’s degree in IT / Cybersecurity or related field
Certifications (Preferred)
Core
- CISSP / CISM / CRISC
GRC & Risk
- ISO 27001 Lead Implementer / Auditor
- FAIR Certification
Optional (Good to Have)
- CCSP (Cloud Security)
- CEH / GIAC (Security testing awareness)
- ITIL / Agile certifications
XPT Software Australia Pty Ltd Melbourne, Victoria, AUS Office
Melbourne, Australia
Similar Jobs
Blockchain • eCommerce • Fintech • Payments • Software • Financial Services • Cryptocurrency
Lead technical onboarding and activation for Square's merchants, managing complex implementation projects from discovery and solution validation through deployment. Coordinate with Sales, Account Management, Product, Engineering, Marketing, and Customer Success; communicate technical requirements; manage risks, timelines, and resources; support data migration; and translate seller needs into product feedback. The role also drives process improvements using AI-powered automation and requires up to 10% travel.
Top Skills:
Ai-Powered AutomationPayment TechnologyPoint-Of-Sale (Pos) SystemsSquare
Cloud • Fintech • Information Technology • Machine Learning • Software
Site Reliability Engineer responsible for improving reliability across Xero’s global platform. The role involves building Kubernetes operators and automated tooling, enhancing AWS telemetry and alerting, implementing chaos engineering, load shedding, and rate limiting, and coordinating incident management and post-incident reviews. The engineer partners with product and infrastructure teams to design resilient systems, diagnose distributed-system issues, and apply sustainable reliability improvements.
Top Skills:
Amazon EcsAWSC#Chaos EngineeringGoKubernetesPython
Cloud • Security • Software • Cybersecurity • Automation
Leads Sales recruiting across APJ, managing recruiters and partnering with Sales leaders to develop scalable hiring strategies. Oversees recruiting for senior and specialized sales roles, advises on regional talent markets, embeds equitable hiring practices, uses recruiting analytics to improve performance, and coordinates workforce planning with cross-functional partners. The role requires hands-on recruiting leadership across multiple countries in a remote-first environment.
What you need to know about the Melbourne Tech Scene
Home to 650 biotech companies, 10 major research institutes and nine universities, Melbourne is among one of the top cities for biotech. In fact, some of the greatest medical advancements were conceptualized and developed here, including Symex Lab's "lab-on-a-chip" solution that monitors hormones to predict ovulation for conception, and Denteric's vaccine for periodontal gum disease. Yet, the thousands of people working in the city's healthtech sector are just getting started, to say nothing of the tech advancements across all other sectors.
