--- title: 'Senior Governance, Risk & Compliance (GRC) Consultant at Dijital Team' canonical: 'https://feeny.ai/job/senior-governance-risk-compliance-grc-consultant-dijital-team-colombo-ehq3ss6dhy4s' type: 'job' last_seen: '2026-10-24' --- # Senior Governance, Risk & Compliance (GRC) Consultant at Dijital Team - **Company:** Dijital Team - **Location:** Colombo, Sri Lanka - **Employment:** full-time - **Work type:** remote - **Posted:** 2026-10-19 - **Last confirmed live:** 2026-10-24 - **Apply:** https://jobs.lever.co/dijital-team-pty-ltd/df6c1dfc-cd15-4d86-91b9-ef14ea39cb08 ## Job description - At least eight years of experience in Governance, Risk & Compliance, cybersecurity assurance, internal audit, technology risk, or risk consulting - Proven experience delivering client-facing cybersecurity risk, compliance, and maturity assessments - Ability to independently conduct stakeholder interviews, gather and evaluate evidence, assess controls, and document findings - Experience preparing detailed assessment reports, executive risk summaries, and prioritised remediation recommendations - Strong understanding of cybersecurity governance, enterprise risk management, and compliance principles - Experience collaborating with technical engineers, cybersecurity specialists, business stakeholders, and senior leadership - Ability to manage multiple assessment activities while maintaining high standards of accuracy and professionalism Cybersecurity Frameworks & Risk Management - Strong working knowledge of ISO/IEC 27001, including ISMS requirements, risk assessment, control evaluation, and implementation maturity - Demonstrated experience assessing organisations against the ASD Essential Eight maturity model - Strong understanding of NIST Cybersecurity Framework 2.0 and its application to risk management and organisational maturity - Experience conducting control gap analyses, cybersecurity maturity assessments, and compliance readiness reviews - Understanding of risk registers, inherent and residual risk, control effectiveness, and risk treatment strategies - Knowledge of cybersecurity governance, incident management, third-party risk, business continuity, and disaster recovery AI Governance & Data Protection - Experience in AI governance, data governance, or related risk and compliance disciplines - Working knowledge of ISO/IEC 42001 or other recognised AI governance and risk management frameworks - Understanding of risks associated with organisational AI adoption, including privacy, security, accountability, transparency, and governance - Knowledge of data classification, data protection controls, information lifecycle management, and privacy principles - Ability to assess governance practices and recommend practical improvements Audit, Assurance & Evidence Management - Experience developing or applying structured audit and assurance methodologies - Strong understanding of evidence collection, sampling, control testing, and audit working paper standards - Ability to distinguish between control design, implementation, and operating effectiveness - Experience documenting objective findings that are traceable to supporting evidence - Understanding of assessment independence, quality assurance, and professional ethics - Ability to produce defensible assessment conclusions for management and external stakeholders Regulatory & Industry Knowledge - Experience working with Australian organisations, particularly in regulated sectors such as financial services, healthcare, government, or critical infrastructure, is advantageous - Familiarity with APRA CPS 234, APRA CPS 230, the Security of Critical Infrastructure Act, the Australian Privacy Act 1988, and Australian Privacy Principles is desirable - Knowledge of SOC 2, ISO/IEC 27701, ISO 22301, and other relevant assurance frameworks is beneficial - Understanding of the NIST AI Risk Management Framework is advantageous - Experience with GRC platforms, risk registers, compliance management systems, or evidence management tools is beneficial - Experience providing ongoing GRC advisory services, virtual CISO support, or continuous compliance assurance is highly regarded - Familiarity with Microsoft Purview, Microsoft Defender, Microsoft Entra ID, and Azure governance is beneficial Reporting, Communication & Consulting - Exceptional written English and the ability to produce polished reports for senior executives and Boards - Ability to translate complex technical and compliance matters into clear business risks and actionable recommendations - Strong presentation, workshop facilitation, and stakeholder engagement skills - Experience preparing executive summaries, risk dashboards, maturity assessments, and remediation roadmaps - Confidence communicating difficult findings constructively and professionally - Strong analytical thinking, attention to detail, and structured problem-solving abilities Professional Attributes - Sound professional judgement and the ability to reach objective, evidence-based conclusions - Strong integrity, independence, and willingness to challenge unsupported claims - A practical consulting mindset focused on customer objectives and meaningful business outcomes - Commercial awareness and the ability to balance security, risk, regulatory obligations, and operational realities - Strong collaboration skills while maintaining accountability for independent assurance conclusions - Commitment to keeping up to date with evolving cybersecurity frameworks, regulations, emerging risks, and AI governance requirements - Ownership of assessment quality, completeness, and delivery ## Preferred Certifications Candidates should ideally hold one or more of the following certifications or demonstrate equivalent professional knowledge and experience: - ISO/IEC 27001 Lead Auditor - ISO/IEC 27001 Lead Implementer - Certified Information Systems Auditor (CISA) - Certified Information Security Manager (CISM) - Certified in Risk and Information Systems Control (CRISC) - IAPP Artificial Intelligence Governance Professional (AIGP) - ISACA Advanced in AI Audit (AAIA) - ISO/IEC 42001 Lead Auditor or Lead Implementer Additional qualifications in risk management, privacy, cybersecurity governance, or relevant regulatory frameworks will be highly regarded. ## Responsibilities Cybersecurity Risk & Compliance Assessments - Plan, coordinate, and deliver cybersecurity readiness, gap, and maturity assessments for commercial and regulated customers - Assess organisations against recognised frameworks, including ISO/IEC 27001, ASD Essential Eight, NIST Cybersecurity Framework 2.0, and ISO/IEC 42001 - Evaluate the design, implementation, and operating effectiveness of security, governance, and risk management controls - Conduct stakeholder interviews, review policies and procedures, and examine technical evidence - Assess risk management, incident response, business continuity, access management, and third-party risk processes - Identify control gaps, governance weaknesses, compliance risks, and improvement opportunities - Ensure findings are accurate, traceable, evidence-based, and defensible Risk-Based Reporting & Executive Advisory - Translate technical findings and control deficiencies into clearly articulated business risks and organisational impacts - Prepare comprehensive assessment reports for senior management, executive leadership teams, and Boards - Develop executive summaries, risk heatmaps, maturity assessments, control gap analyses, and prioritised recommendations - Explain cybersecurity risks in the context of business operations, regulatory obligations, financial exposure, and organisational resilience - Present findings and recommendations to customer stakeholders, including senior executives and Board representatives - Advise customers on risk treatment options, remediation priorities, and governance improvements Assessment Methodology & Quality Assurance - Contribute to the development and continuous improvement of managed assurance assessment methodologies - Develop and maintain standardised assessment templates, control testing procedures, evidence requirements, and reporting formats - Establish consistent approaches to risk scoring, maturity assessment, gap analysis, and remediation prioritisation - Maintain documented assessment criteria and evidence standards to support transparency and repeatability - Apply quality assurance, peer review, and independent assessment principles - Identify and manage potential conflicts of interest between assurance activities and technical remediation services - Maintain complete assessment records, supporting evidence, and working papers - Monitor changes to frameworks, standards, and regulatory requirements and recommend updates to assessment methodologies Risk Remediation Planning & Technical Collaboration - Collaborate with cybersecurity, infrastructure, cloud, and operations teams to validate technical findings and supporting evidence - Assess the effectiveness of technical and administrative security controls - Translate control deficiencies into practical, prioritised remediation recommendations - Develop remediation roadmaps that account for risk severity, business impact, regulatory requirements, implementation complexity, and available resources - Help customers determine appropriate risk treatment strategies, including remediation, mitigation, acceptance, and transfer - Guide technical teams on governance and compliance requirements associated with remediation - Validate remediation evidence and confirm whether identified gaps have been appropriately addressed - Maintain appropriate separation between independent assurance and technical implementation responsibilities Continuous Governance & Assurance - Support ongoing governance and assurance services to help customers maintain and improve their compliance posture - Conduct periodic reviews of security controls, risk registers, policies, compliance obligations, and remediation progress - Help customers maintain cybersecurity governance frameworks, risk management processes, and compliance documentation - Monitor changes in organisational risk profiles, emerging threats, regulatory requirements, and control effectiveness - Support ongoing risk assessments, control monitoring, and compliance reporting - Prepare recurring governance reports, risk dashboards, and management updates - Participate in governance meetings, risk committee discussions, and executive reporting - Identify opportunities to improve risk ownership, accountability, and governance maturity - Promote continuous improvement rather than reliance solely on annual or point-in-time assessments AI Governance & Data Protection - Assess and improve organisational governance arrangements for artificial intelligence and data management - Conduct AI governance readiness and maturity assessments aligned with ISO/IEC 42001 and relevant AI risk management principles - Evaluate AI governance policies, accountability structures, risk assessment processes, and oversight mechanisms - Identify risks associated with AI adoption, including data privacy, security, transparency, bias, third-party dependencies, and inappropriate use - Assess controls for responsible AI adoption, including risk classification, human oversight, and monitoring - Review data governance practices covering information classification, data handling, retention, access controls, and privacy obligations - Develop practical recommendations to strengthen AI and data governance - Monitor developments in AI governance standards and regulatory expectations Regulatory Compliance & Industry Frameworks - Assess customer security and governance practices against applicable legislative and regulatory obligations - Support compliance readiness and gap assessments for regulated Australian organisations - Evaluate requirements associated with APRA CPS 234, APRA CPS 230, the Security of Critical Infrastructure Act, and the Australian Privacy Act 1988 and Australian Privacy Principles - Explain how regulatory obligations translate into governance, security, and operational controls - Identify regulatory compliance gaps and develop risk-based improvement recommendations - Collaborate with customer stakeholders and relevant specialists to support regulatory assurance initiatives Client Engagement & Consulting Delivery - Participate in customer discovery sessions, assessment workshops, and stakeholder interviews - Build trusted professional relationships with executives, risk owners, IT leaders, and security teams - Manage assigned assessment activities against agreed timelines, quality standards, and deliverables - Clearly communicate assessment requirements, evidence requests, findings, and recommendations - Exercise sound professional judgement when evaluating incomplete evidence, control effectiveness, and risk exposure - Contribute to assessment scopes, delivery plans, and customer proposals as required - Support the ongoing improvement of managed assurance service offerings ## How we take care of our team ๐Ÿ’ฐ Get paid in Australian Dollars ๐Ÿฅ Medical insurance from day one for you + spouse (or parents if unmarried) ๐Ÿฉบ Generous OPD coverage from doctor visits to all your medical needs ๐Ÿก Home office setup allowance to build your ideal workspace ๐ŸŒ Internet allowance to keep you connected ๐Ÿ’ช Gym & wellness allowance to stay fit and balanced ๐ŸŽ‰ Work hard, play hard โ€“ regular team events & engagement activities ๐Ÿง  Diji Assist โ€“ Mental health & counseling support when you need it ๐Ÿ“š We invest in you โ€“ reimbursement for industry certifications ๐Ÿ—ฃ๏ธ Open-door culture โ€“ your ideas and feedback always matter ๐ŸŒ Flexible work โ€“ home or office, wherever you do your best work ๐Ÿ† Rewards & recognition that actually recognize you ๐Ÿฅณ Great christmas & financial year-end parties to unwind with your loved ones ## About Dijital Team ## Company Overview - **One-liner**: Dijital Team is a global technology services provider that builds dedicated offshore IT teams for MSPs and IT businesses, enabling them to accelerate growth and improve margins. - **Entity Type**: Private (bootstrapped; no disclosed funding) - **Headquarters**: Australia (Registered) / Colombo, Sri Lanka (Operational) - **Founded**: ~2023 (inferred from Managing Directorโ€™s statement that the business was โ€œ02 years agoโ€ as of 2025) - **Founders**: Peter Ward (Managing Director) ## Core Business - **Primary industry**: Information Technology / ITES โ€“ Offshore Staffing & Managed Services - **Target customers**: B2B โ€“ MSPs (Managed Service Providers), IT businesses, and technology service brands looking to extend their teams remotely - **Mission**: โ€œCreate better businesses by creating the best place to work in Sri Lanka.โ€ ## Products & Services - **Dedicated Offshore Teams**: Fully managed, 100% dedicated teams designed to client specifications โ€“ covering IT support, infrastructure management, automation, data analytics, and software development. - **IT Support & Helpdesk**: 365x24x7 support to increase response times and customer satisfaction. - **Automation & RPA**: Robotic Process Automation and RMM engineering to improve efficiency. - **Dynamics 365 (F&O) Support**: Specialized application support for Microsoft Dynamics 365 Finance & Operations. - **Data Analytics & Reporting**: Accelerated reporting and data-driven insights. ## Market Standing - **Valuation**: Not disclosed - **Key Metric**: 232 employees (as of 2025, per Great Place to Work certification) - **Notable Investors/Partners**: None publicly listed - **Growth Signals**: - Awarded **Great Place to Workยฎ** certification in Sri Lanka (2025) โ€“ recognized for โ€œRespectโ€ and exceptional work-life balance. - Rapidly built a team of 232 within two years of inception. - Serves clients across Australia, Europe, US, and UK. ## Competitive Advantages - **Speed to Scale**: Can set up a dedicated IT team in as little as four weeks. - **Employee-Centric Model**: High retention driven by a culture that prioritizes team member delight โ€“ leading to better client outcomes. - **Remote-First, Globally Distributed**: Leverages a remote workforce across time zones, offering 24/7 coverage at a fraction of onshore costs. - **Compensation in AUD**: Competitive salaries paid in Australian Dollars, providing financial stability for Sri Lankan talent. ## Strategic Focus - **Expand Offshore Capacity**: Continue building dedicated teams for MSPs and IT businesses, emphasizing quality, speed, and employee satisfaction. - **Deepen Client Partnerships**: Offer end-to-end service from recruitment and training to HR and payroll, freeing clients to focus on growth. - **Maintain Employer of Choice Status**: Invest in benefits, career development, and a flexible remote culture to sustain the โ€œBest Place to Workโ€ reputation. ## Why Work Here - **Remote-First Culture**: Fully remote roles with flexible working hours โ€“ โ€œwork can be done anywhere.โ€ - **Competitive Remuneration**: Salaries paid in Australian Dollars, plus a technology allowance and wellness allowance. - **Comprehensive Benefits**: Medical & life insurance from day one (including family), employee assistance program (counselling/mental health), and remote medical support. - **Career Development**: Access to ongoing training, industry certifications, and exposure to modern technologies. - **Great Place to Workยฎ Certified**: Independently recognized for strong work-life balance, respect, and a supportive management team. - **Modern Hiring Process**: Includes recruiter screen, video assessment, and technical assessment (role-dependent) โ€“ with AI-assisted screening but final human decisions. ## Sources 1. [dijitalteam.com](https://www.dijitalteam.com/) 2. [dijitalteam.lk](https://www.dijitalteam.lk/) 3. [jobs.lever.co](https://jobs.lever.co/dijital-team-pty-ltd) 4. [greatplacetowork.lk](https://greatplacetowork.lk/best-workplace/dijital-team/) ## Other roles at Dijital Team - [Senior Backup Engineer](https://feeny.ai/job/senior-backup-engineer-dijital-team-colombo-716kzc5vewzr) โ€” Colombo, Sri Lanka - [Senior Microsoft Engineer (Level 3) | Azure | M365 | Security](https://feeny.ai/job/senior-microsoft-engineer-level-3-azure-m365-security-dijital-team-colombo-s0ppnzratvc4) โ€” Colombo, Sri Lanka - [Product Manager](https://feeny.ai/job/product-manager-dijital-team-colombo-rhkrxxn23vc3) โ€” Colombo, Sri Lanka - [L2 Support Engineer](https://feeny.ai/job/l2-support-engineer-dijital-team-colombo-v38htfmb6zcr) โ€” Colombo, Sri Lanka - [Financial Controller](https://feeny.ai/job/financial-controller-dijital-team-colombo-2hr1nzk4b3wy) โ€” Colombo, Sri Lanka - [Marketing Specialist](https://feeny.ai/job/marketing-specialist-dijital-team-sri-lanka-208sbp0kemr9) โ€” Sri Lanka - [Security Engineer L3](https://feeny.ai/job/security-engineer-l3-dijital-team-colombo-95fsh6rykqw1) โ€” Colombo, Sri Lanka - [End User Compute Engineer (Citrix & Azure Virtual Desktop )](https://feeny.ai/job/end-user-compute-engineer-citrix-azure-virtual-desktop-dijital-team-colombo-1t9aryd47mdx) โ€” Colombo, Sri Lanka - [Senior SharePoint and Copilot Consultant](https://feeny.ai/job/senior-sharepoint-and-copilot-consultant-dijital-team-sri-lanka-9reeq8s01rsd) โ€” Sri Lanka - [Sales Administrator (Microsoft 365 and Microsoft licensing. )](https://feeny.ai/job/sales-administrator-microsoft-365-and-microsoft-licensing-dijital-team-colombo-be9xrca54jnz) โ€” Colombo, Sri Lanka