WHO WE ARE

Employment Hero is on a mission to make employment easier and more valuable for everyone. Our Employment Operating System brings hiring, HR, payroll and benefits into an all-in-one solution.
Since our inception in 2014, we’ve scaled to a $2 billion valuation and gained a presence in 6 countries globally - Australia, New Zealand, Singapore, Malaysia, the UK and Canada. We now service over 300,000 businesses and more than 2 million employees.

THIS ROLE

As our Security GRC Specialist, you’ll be working with the Global Security GRC Team and will be instrumental in shaping the information security management strategy for Employment Hero.

Your key focus areas will be:

• Operate the information security management system across Employment Hero.
• Develop and execute a holistic information security strategy that aligns with the company’s objectives and effectively mitigates cyber threats.
• Write and maintain information security policies to ensure compliance and the protection of sensitive data.
• Support the improvement and management of our cyber security capabilities.
• Stay up to date with the latest cybersecurity threats, trends, and technologies, and proactively recommend enhancements to the company’s security posture.
• Collaborate with internal stakeholders, including IT, product, legal, and engineering teams, to identify security requirements and implement appropriate controls and safeguards.
• Respond to compliance audit requests and demonstrate a strong understanding of compliance frameworks and regulations such as ISO27001, SOC2.
• Conduct internal audits and provide recommendations to key stakeholders based on findings.
• Implement and maintain security tools and systems to ensure optimal performance and address evolving threats

To thrive at Employment Hero, you’ll need to embody The EH Way - operating with focus, agility, and an obsession with impact. For this role, you’ll also bring:

• A degree in information technology, information security, risk management, or equivalent work experience.
• Industry certifications such as CISSP, CISM or CISA are highly desirable
• Demonstrated knowledge and understanding of contemporary frameworks and methodologies, such as ISO 27001, SOC2, NIST 800-53, NIST Cyber Security Framework (CSF), and Australian Information Security Manual (ISM).
• Excellent written, oral, and influencing skills with the ability to work autonomously.
• A strong focus on continuous improvement, with a proven ability to challenge the status quo constructively.
• Broad knowledge of current Governance, Risk and Compliance (GRC) technological tools and methodologies.
• Strong consultative skills, enabling effective communication of complex concepts to both technical and non-technical audiences.
• Meticulous attention to detail.
• A strong desire to learn and expand knowledge in the field of information security