GRC Technical Lead

Schedule: Monday - Friday (07:00 AM - 04:00 PM PHT) What are we looking for? Skills Required: 6-9 years of hands-on experience across GRC, Cyber Risk, TPRM, or Internal Audit, ideally within consulting or regulated environments. Demonstrated ability to map risks (L1/L2/L3) to controls and regulatory obligations, perform gap assessments, and develop treatment plans. Deep knowledge of Australian regulatory frameworks including APRA CPS 230/232/234, SOCI Act, Privacy Act, and AESCSF. Working knowledge of cybersecurity frameworks and domains, including ISO 27001, NIST CSF, COBIT, Essential 8, IAM, Cloud, and Data Security. Hands-on experience with GRC/TPRM platforms (e.g., Process Unity, Archer, ServiceNow etc). Strong analytical and documentation skills — capable of producing executive-level reports, control matrices, and risk dashboards. Excellent stakeholder engagement, client presentation, and communication skills. Certifications such as CISA, CRISC, CISSP, ISO 27001 Lead Auditor/Implementer, CIA, CGEIT, or CTPRP highly regarded. What will you do? Design, implement, and mature enterprise-grade Governance, Risk & Compliance (GRC) frameworks, policies, and operating models across multiple clients and sectors. Lead risk identification, assessment, and mapping activities (L1/L2/L3) to define risk treatment and mitigation plans aligned with organisational strategy. Develop, maintain, and enhance control libraries mapped to enterprise risks and frameworks such as ISO 27001, NIST CSF 2.0, AESCSF, COBIT, and Essential 8. Conduct controls testing and evidence collection across both design and operating effectiveness, ensuring controls are properly designed, implemented, and performing as intended. Coordinate the end-to-end assurance lifecycle — planning, evidence gathering, testing execution, gap identification, remediation tracking, and management reporting. Lead Third-Party Risk Management (TPRM) processes — vendor due diligence, onboarding/offboarding, ongoing monitoring, and assurance automation. Oversee regulatory compliance and obligations management under APRA CPS 230/232/234, SOCI Act, Privacy Act, and related frameworks. Develop and maintain risk registers, issues logs, compliance registers, KRIs, and executive dashboards to support governance and board reporting. Partner with cybersecurity domains — IAM/PAM, Cloud, Data Protection, OT/ICS, and SOC Operations — to ensure effective control integration and risk reduction. Lead and manage internal/external audits, coordinate evidence provision, and support responses to regulators or certification bodies. Draft and maintain policies, standards, procedures, and control narratives, ensuring traceability from obligations to evidence. Apply AI-enabled automation and data intelligence for evidence management, risk scoring, and compliance analytics in collaboration with SecGenX technology partners. Mentor and guide GRC and TPRM analysts, embedding delivery excellence and consistency across engagements. JOIN CONNECTOS NOW ConnectOS is certified as a Great Place to Work and is a top-rated Philippines employer of choice. Get the amazing chance to work for our client — Australia's top supplier of office products for small and medium-sized businesses, students, and households, with a nationwide presence and over 3 billion dollars in revenue. #JoinConnectOS #ConnectOSCareers#ConnectOSNonTech Employment decisions at ConnectOS will be conducted without consideration of factors such as age', race, color, religion, gender, disability status, sexual orientation, gender identity or expression, genetic information, and marital status. ConnectOS ensures the full confidentiality of the data it processes. #J-18808-Ljbffr