Senior Controls & Compliance Specialist

At GHD, we don’t just believe in the power of commitment, we live and breathe it every day.

That’s why we pledge to support and empower all of our people to make a positive impact when working hand in hand with our business to drive change. We’ll help you accelerate your career and empower you with the right technology and training as you bring ideas and projects to life.

Who are we looking for?
Are you an experienced controls and compliance professional who can set clear governance expectations, translate complex obligations into practical requirements, and strengthen compliance without taking over first-line accountabilities? We’re seeking a Senior Controls & Compliance Specialist to lead the definition, alignment and monitoring of control and compliance requirements across Information Services & Technology.

In this senior second-line governance and oversight role, you’ll maintain the enterprise control catalogue and obligation mapping, establish evidence standards, coordinate certification readiness and the policy framework, and provide clear reporting on compliance trends and systemic gaps. You’ll enable accountable function and service owners by setting guardrails and clarifying requirements, without operating their controls, workflows, registers or routine approvals.

As a senior controls and compliance professional, you will:

• Own and maintain the IS&T control catalogue, mapping controls to applicable regulatory, legal, contractual, certification and internal obligations
• Partner with control owners, Cyber Security, Architecture, Engineering, Applications, Data & AI, Privacy, Legal, Commercial and Internal Audit to clarify requirements and improve compliance maturity
• Maintain the obligations register and monitor changes in external requirements, client commitments and internal policies that affect the control environment
• Define minimum control outcomes, evidence standards, templates, traceability requirements and lifecycle expectations for accountable owners
• Define compliance and evidence requirements across areas, including third-party risk, operational exceptions, non-standard software and SaaS, penetration testing, vulnerability management, secure-by-design, enterprise applications, development and delivery, data management and AI
• Monitor compliance, overdue obligations, repeat exceptions, control adoption and systemic gaps, and report material matters to governance forums
• Set response governance, evidence expectations and approved positions for client security questionnaires without authoring routine subject-matter responses or running the submission workflow
• Route material gaps, exceptions and out-of-tolerance matters to the Technology Risk Advisor and authorised decision-makers
• Continuously improve the controls and compliance framework, guidance, reporting and supporting tools as obligations and business needs evolve
• Provide capability across certification and compliance readiness, audit coordination and the IS&T policy framework, helping maintain team coverage while recognising that external assessors make independent certification decisions.

What You’ll Bring

We’re looking for a practical, independent second-line professional who combines controls and compliance expertise with strong judgement, attention to detail and the confidence to challenge constructively. You’ll be able to translate technical, control and compliance matters into clear business implications, establish defensible evidence expectations, and influence accountable owners across a complex global organisation.

You’ll be a strong fit if you have led complex controls, compliance or assurance programs; maintained control frameworks and obligation mappings; coordinated certification readiness; and presented evidence-based outcomes to senior leaders or governance forums.

It’s likely not a fit if your background is primarily hands-on control operation, routine workflow administration or first-line ownership of remediation and operational decisions.

Required Experience

• Ten (10) or more years of relevant experience in technology risk, information security, controls, compliance, assurance or a closely related discipline
• Demonstrated experience defining, maintaining or assessing control frameworks, compliance requirements and evidence standards in a complex environment
• Experience coordinating certification readiness, reviews or assessments and supporting defensible audit submissions
• Strong analytical, problem-solving, written communication, facilitation and stakeholder engagement skills
• Experience presenting clear, actionable outcomes to senior leadership or governance forums
• Ability to work independently, manage competing priorities and maintain appropriate visibility of progress, risks and issues
• Sound judgement, commercial awareness and a practical, proportionate approach to governance
• Ability to lead through influence, build effective virtual teams and mentor less experienced team members

Technical Knowledge

• Experience with some or all of the following is highly desirable:
• ISO/IEC 27001
• NIST frameworks and security controls
• CMMC and client security requirements
• ASD Essential Eight
• Cyber Essentials
• SOC 2 or equivalent assurance frameworks
• Control catalogues, obligation registers and evidence traceability
• Certification readiness, policy governance and compliance reporting
• Third-party risk, vulnerability management, secure-by-design, data management and AI governance requirements
  
   

Qualifications
A degree in Computer Science, Information Systems, Cyber Security, Risk, Business or a related field is highly regarded
Relevant certifications such as CISA, CRISC, CISM, CISSP, ISO 27001 Lead Implementer, ISO 27001 Lead Auditor or equivalent are highly regarded

Benefits: 

• 401K - Employees are eligible to participate on the first day of the month following 3 months of service
• Paid time off – Our PTO benefit is designed to provide eligible employees with a period of rest and relaxation, sick, and personal time throughout the year. PTO starts at 16 days per year and increases with years of service
• Holiday Pay - Holiday pay is provided for eligible employees. GHD observes 9 holidays per year. Holiday pay will be based on the regular set schedule for the employee
• Wellness Benefit- Regular full-term employees are eligible to participate in the wellness reimbursement program. GHD will reimburse 50% of the cost of the following to maximum of $250.00 reimbursement annually for such items as: Health club membership fees, Home exercise equipment purchases, Bicycles, Race, run & marathon entrance fees, Smoking cessation programs, Weight loss programs (i.e.—Weight Watchers, Jenny Craig), Fitbits and Fitness Tracking devices
   

Salary range: $98,250.00 - $163,750.00 based on experience and location

Interested? Apply Now.

As a multicultural organization, we encourage individual achievement and recognize the strength of a diverse workforce. GHD is an equal opportunity employer. We provide equal employment opportunities to all qualified employees and applicants without regard to race, creed, religion, national origin, citizenship, color, sex, sexual orientation, gender identity, age, disability, marital status or veteran status.

#LI-JW1
 

About the company

Take on some of the world’s toughest challenges - with GHD supporting you every step of the way.