JobCubby JobCubby
Sign up
R

GRC Security Engineer

Rush Digital Albert-Eden, Auckland, New Zealand

Marketing Services · 11-50 employees

9 h ago
security Mid (2-5 yrs) Full-time New Zealand
Create a free account to apply — email only, no card. You can also save this posting or score it against your profile with AI.

Applying here? Try the free cover letter tool — paste this posting and your résumé, no account needed.

About the role

The GRC Security Engineer will own and manage the ISO 27001 and PCI DSS compliance programs to ensure continuous audit readiness. They will also draft security policies, conduct risk reviews, and automate evidence collection to streamline security operations.

What they look for

ISO 27001 PCI DSS ISMS Risk management Audit preparation Evidence automation Security policies Third-party risk AI governance Government assurance NZISM Security awareness training Cloud configuration Compliance tooling Stakeholder engagement

Requirements

Candidates should have 3 to 5 years of experience in GRC, audit, or security compliance with hands-on knowledge of ISO 27001 and PCI DSS v4. Strong technical depth and the ability to engage effectively with stakeholders are essential for this role.

Benefits

Flexible working Hybrid arrangement

Full description

At RUSH, we design, build, and manage purposeful digital experiences that improve people's lives.

Our clients trust us with their systems and data. Our ISO 27001 certification and PCI DSS compliance are part of how we earn that trust, and it needs to hold up every day, not only when the auditors arrive.

We're looking for a GRC Engineer to own our ISO 27001 and PCI DSS programmes and keep RUSH audit-ready all year round.

You'll run the ISMS, lead client and government assurance work, and set the policies that guide how we build and operate. You'll also bring enough technical depth to check that controls work in practice, and you'll automate evidence collection so audits become a by-product of normal work. 

Key accountabilities and responsibilities

Certification and compliance programmes

  • ISO 27001 ISMS: Run the information security management system, including the risk register, Statement of Applicability, internal audits, management review and surveillance audits.
  • PCI DSS: Run the annual PCI DSS v4 assessment and keep evidence current through the year.
  • Evidence automation: Automate evidence collection wherever possible, so audits become a by-product of normal work rather than a seasonal scramble.

Policy and risk

  • Security policies: Draft and maintain security policies for Hamish to approve, and track exceptions.
  • Third-party risk: Run third-party and vendor risk reviews.
  • AI governance: Own AI governance and policy, alongside the Architect's technical controls.

Client and government assurance

  • Government assurance: Lead NZISM and government assurance work, partnering with the Architect on technical assessments.
  • Client security requests: Own client security questionnaires, trust packs and the security sections of RFPs.

Security culture

  • Awareness training: Run security awareness training across RUSH and track completion.

About you

Experience and qualifications

  • Experience: Around 3 to 5 years in GRC, audit or security compliance.
  • ISO 27001: Hands-on experience, ideally through at least one certification or surveillance audit.
  • PCI DSS: Working knowledge of PCI DSS v4.
  • Nice to have: ISO 27001 Lead Implementer or Lead Auditor, CISA, or NZISM experience.

Technical skills

  • Enough technical depth to read a cloud configuration or pipeline and judge whether a control is really working.
  • Experience automating evidence collection or using compliance tooling to monitor controls.

Key competencies

  • Clear writing: Writes policies, client responses and audit findings that are accurate and easy to act on.
  • Pragmatism: Right-sizes controls and policies to the risk, so security supports delivery rather than slowing it down.
  • Stakeholder engagement: Works with engineers, delivery leads, clients and auditors to agree what good looks like and get it done.
  • Ownership: Keeps programmes moving all year without waiting for an audit deadline.

What we offer

  • Ownership: Clear ownership of RUSH's ISO 27001 and PCI DSS programmes, with direct access to our CISO.
  • Impact: The chance to make compliance continuous and largely automated, rather than a yearly scramble.
  • Breadth: Variety across certification, government assurance, client trust, vendor risk and AI governance.
  • Flexible working: Parnell Office location and hybrid arrangement

Similar roles