Job Description

Betashares is continuing to strengthen its cyber governance, technology risk and regulatory compliance capabilities as the business grows.

We are looking for an experienced, hands-on Cyber GRC professional to take ownership of key governance, risk and compliance activities across our technology environment. Working closely with the Head of IT and broader Technology team, you will ensure our information security policies, standards and controls are fit for purpose, meet regulatory obligations and translate into practical processes across the business.

This role requires a strong understanding of financial services regulation, particularly APRA CPS 234 and CPS 230, alongside ISO 27001. This is an individual contributor role suited to someone who has previously operated with a high level of ownership and autonomy. We're looking for someone who enjoys getting involved in the detail, takes a practical approach to GRC and wants the opportunity to further develop and shape the function as Betashares continues to grow.

Role Responsibilities

• Own and maintain information security policies, standards and procedures, ensuring they are fit for purpose, clearly documented and embedded into day-to-day business operations.
• Translate APRA CPS 234, CPS 230 and ISO 27001 requirements into practical controls, processes and compliance activities.
• Drive the execution of technology risk, cyber governance and compliance initiatives, ensuring actions are delivered through to completion.
• Maintain and improve control frameworks, risk registers, remediation plans and supporting governance documentation.
• Coordinate control assessments, testing and assurance activities, working closely with Technology, Security, Risk and Compliance teams.
• Prepare and manage audit and regulatory review requirements, including evidence collection, control walkthroughs, action tracking and remediation.
• Identify gaps in existing policies, controls and processes, recommending and implementing practical improvements.
• Support third-party security risk assessments, including CPS 230 material service provider requirements.
• Develop and improve GRC workflows, reporting and evidence management processes, identifying opportunities for automation and efficiency.
• Partner with technical and business stakeholders to ensure security and compliance requirements are understood, implemented and maintained.
• Provide clear reporting on compliance activities, outstanding risks, remediation progress and areas requiring attention.
• Take ownership of ongoing GRC improvements, helping to strengthen the function as the business continues to grow.

Key Skills and Experience

Must-haves

• Proven experience in Cyber GRC, Technology Risk, Information Security Governance or a closely related role, ideally with 4+ years of relevant experience.
• Previous experience working within financial services, with a strong understanding of regulatory obligations and technology risk requirements in Australian regulations
• Practical experience with APRA CPS 234 and CPS 230, including translating regulatory requirements into controls, policies, procedures and compliance activities.
• Strong working knowledge of ISO 27001, including information security management systems, control frameworks and assurance requirements.
• Demonstrated experience developing, reviewing and implementing information security policies, standards and procedures, ensuring they are practical and fit for purpose.
• Hands-on experience delivering technology risk and compliance activities, including control assessments, audit preparation, evidence management and remediation tracking.
• Experience operating in an internal GRC, Technology Risk or Information Security function, with direct responsibility for executing and improving compliance processes.
• Experience supporting client-facing security and technology risk assurance, including due diligence requests, security assessments and compliance evidence.
• Experience preparing Board and Committee reports, communicating key technology risks, compliance updates and remediation activities.
• Ability to work independently, manage competing priorities and take ownership of deliverables
• Strong stakeholder engagement skills, with the ability to work effectively across Technology, Security, Risk, Compliance and broader business teams.
• Good technical understanding of information security controls, cloud environments, identity and access management, vulnerability management and broader technology risk concepts.
• Strong written communication skills, with the ability to translate complex regulatory requirements into clear, practical documentation and business processes.

Nice-to-haves

• Experience supporting APRA regulatory reviews, audits or compliance uplift programmes.
• Exposure to third-party risk management, including CPS 230 material service provider assessments.
• Experience with GRC platforms or compliance automation tools such as ServiceNow IRM, Vanta or Drata.
• Familiarity with SOC 2, additional security frameworks or broader regulatory assurance requirements.
• Experience improving or automating compliance workflows, evidence collection or control monitoring.
• Relevant certifications such as CISA, CRISC, CISSP, ISO 27001 Lead Implementer or Lead Auditor.
• Experience working in a lean technology or security team where broader ownership, adaptability and a hands-on approach are required.