GRC & Security Ops Lead

Our ISO 27001 certification and PCI DSS compliance are part of how we earn that trust, and it needs to hold up every day, not only when the auditors arrive. We're looking for a GRC Engineer to own our ISO 27001 and PCI DSS programmes and keep RUSH audit-ready all year round.

About rushdigital

• At RUSH, we design, build, and manage purposeful digital experiences that improve people's lives.
• Our clients trust us with their systems and data.

Responsibilities

• You'll run the ISMS, lead client and government assurance work, and set the policies that guide how we build and operate.
• You'll also bring enough technical depth to check that controls work in practice, and you'll automate evidence collection so audits become a by-product of normal work.
• Key accountabilities and responsibilities Certification and compliance programmes ISO 27001 ISMS: Run the information security management system, including the risk register, Statement of Applicability, internal audits, management review and surveillance audits.
• Run the annual PCI DSS v4 assessment and keep evidence current through the year.
• Automate evidence collection wherever possible, so audits become a by-product of normal work rather than a seasonal scramble.
• Draft and maintain security policies for Hamish to approve, and track exceptions.
• Run third-party and vendor risk reviews.
• Own AI governance and policy, alongside the Architect's technical controls.
• Lead NZISM and government assurance work, partnering with the Architect on technical assessments.
• Own client security questionnaires, trust packs and the security sections of RFPs.
• Works with engineers, delivery leads, clients and auditors to agree what good looks like and get it done.

Requirements

• Run security awareness training across RUSH and track completion.
• Around 3 to 5 years in GRC, audit or security compliance.
• ISO 27001: Hands-on experience, ideally through at least one certification or surveillance audit.
• Working knowledge of PCI DSS v4.
• Enough technical depth to read a cloud configuration or pipeline and judge whether a control is really working.
• Experience automating evidence collection or using compliance tooling to monitor controls.
• Right-sizes controls and policies to the risk, so security supports delivery rather than slowing it down.
• Keeps programmes moving all year without waiting for an audit deadline.
• Clear ownership of RUSH's ISO 27001 and PCI DSS programmes, with direct access to our CISO.
• Variety across certification, government assurance, client trust, vendor risk and AI governance.

Preferred

• ISO 27001 Lead Implementer or Lead Auditor, CISA, or NZISM experience.
• The chance to make compliance continuous and largely automated, rather than a yearly scramble.

Key competencies Clear writing

Writes policies, client responses and audit findings that are accurate and easy to act on.

Flexible working

Parnell Office location and hybrid arrangement