WHO WE ARE

Employment Hero is on a mission to make employment easier and more valuable for everyone. Our Employment Operating System brings hiring, HR, payroll and benefits into an all-in-one solution.
Since our inception in 2014, we’ve scaled to a $2 billion valuation and gained a presence in 6 countries globally - Australia, New Zealand, Singapore, Malaysia, the UK and Canada. We now service over 300,000 businesses and more than 2 million employees.

THIS ROLE

As our Security GRC Manager, you’ll be leading the Global Security GRC Team and will be instrumental in shaping the information security management strategy for Employment Hero, making sure we are at the forefront of information security excellence.

Your key focus areas will be

• Leadership and Team Management - Lead and manage a team of Security GRC professionals, providing guidance, mentorship, and support in their professional development.
• Strategic Security Planning: Develop and drive the organisation’s overarching information security and GRC strategy, ensuring alignment with business objectives and proactive mitigation of security risks.
• Governance, Risk, and Compliance Oversight - Oversee the design, implementation, and continuous improvement of security governance processes, risk management frameworks, and compliance programs to ensure robust risk mitigation and regulatory compliance (eg. ISO 27001, SOC2, etc.)
• Auditing and Compliance Reporting Lead internal and external security audits, ensuring the organisation meets compliance requirements and deadlines. Coordinate with auditors and facilitate the audit process, addressing gaps and driving remediation efforts based on audit findings. Ensure timely preparation and management of audit documentation and evidence.
• Policy Development and Enforcement - Establish and maintain high-level information security policies, procedures, and standards. Ensure that they are effectively enforced and aligned with industry best practices and compliance requirements.
• Stakeholder Collaboration - Serve as the primary liaison between internal stakeholders (IT, legal, compliance, product, engineering) to ensure effective implementation of security and risk initiatives and promote a culture of security across the organisation.
• Risk Assessment and Reporting - Lead regular risk assessments, audits, and vulnerability assessments. Provide strategic recommendations to senior leadership based on findings and industry best practices.
• Security Incident Management - Oversee and guide the response to security incidents, ensuring rapid remediation, effective communication, and root cause analysis.
• Training and Awareness - Foster a security-conscious culture by developing and delivering security training programs, ensuring that employees at all levels understand their role in maintaining information security.
• Continuous Improvement and Innovation - Stay current with emerging trends in information security, governance, and compliance. Recommend and implement continuous improvements to enhance security practices and safeguard the organisation’s data and assets.
• Compliance Reporting and Audit Management - Ensure the company meets compliance requirements and audit deadlines. Prepare and manage compliance documentation, working with external auditors when necessary.

To thrive at Employment Hero, you’ll need to embody The EH Way - operating with focus, agility, and an obsession with impact. For this role, you’ll also bring

• A degree in information technology, information security, risk management, or equivalent work experience.
• Industry certifications such as CISSP, CISM or CISA are highly desirable
• Leadership & Communication Skills - Proven ability to lead and manage a team, with strong consultative, written, and verbal communication skills. Ability to influence stakeholders at all levels of the organization.
• Demonstrated knowledge and understanding of contemporary frameworks and methodologies, such as ISO 27001, NIST 800-53, SOC2
• Excellent written, oral, and influencing skills with the ability to work autonomously.
• A strong focus on continuous improvement, with a proven ability to challenge the status quo constructively.
• Broad knowledge of current Governance, Risk and Compliance (GRC) technological tools and methodologies.
• Strong consultative skills, enabling effective communication of complex concepts to both technical and non-technical audiences.
• Meticulous attention to detail.
• A strong desire to learn and expand knowledge in the field of information security