Risk & Assurance Lead

About Atmail
Atmail is an Australian-headquartered technology company providing secure and reliable email solutions to millions of users worldwide. With more than 25 years of experience and a globally distributed team, we support both consumer and business customers.
We're looking for an experienced, hands-on Risk & Assurance Lead to help strengthen our governance, risk and compliance (GRC) capabilities and establish a robust controls assurance function.
The Opportunity
Reporting to the Director – Compliance and Trust, you'll take ownership of Atmail's enterprise risk framework, controls assurance program and key compliance activities.
This is an opportunity to build and shape a function, not simply maintain existing processes. You'll work closely with security, engineering and business stakeholders to ensure risks are understood, controls are effective and compliance is supported by clear evidence.
Key Responsibilities
Develop and maintain the enterprise risk framework, risk registers and controls assurance program.
Build and manage a controls register aligned with ISO 27001, PCI-DSS and internal policies.
Plan and conduct control testing to assess design and operating effectiveness.
Manage risk assessments, treatment plans, risk appetite thresholds and remediation activities.
Oversee ISO 27001 certification activities, including ISMS management, surveillance audits and recertification.
Coordinate compliance evidence, audit readiness and external audit activities.
Prepare clear, meaningful risk and assurance reporting for senior leadership and the Board.
Work collaboratively with technical and business teams to address control gaps and strengthen risk management.
Provide oversight and guidance to the Risk Operations Coordinator.
About You
We're seeking a practical GRC professional who combines strong risk management expertise with genuine hands-on controls assurance experience.
You'll bring:
Proven experience leading or owning risk, compliance or controls assurance activities, ideally within a technology, SaaS or regulated environment.
Strong practical experience with ISO 27001, Information Security Management Systems (ISMS) and external audits.
Hands-on experience developing controls registers and testing control effectiveness.
Demonstrated experience managing enterprise risk registers, risk assessments, treatment plans and risk appetite.
A sound understanding of information security controls and cloud environments, with the ability to engage confidently with technical teams.
Experience preparing concise risk and compliance reporting for senior stakeholders.
Strong communication and stakeholder management skills, with the confidence to challenge decisions and drive accountability.
The ability to work autonomously, establish processes and deliver outcomes in a lean, remote environment.
Experience with PCI-DSS, GRC automation tools such as Drata, or additional risk and security frameworks would be advantageous.
Why Join Atmail?
You'll have the opportunity to make a meaningful impact within an established global technology business, helping shape its approach to enterprise risk and assurance.
You'll enjoy a fully remote working environment, collaborate with experienced security and technology professionals, and have genuine ownership of a function that is continuing to evolve.
If you're a hands-on risk and assurance professional who enjoys building effective frameworks, improving controls and working collaboratively with the business, we'd love to hear from you.
Apply now to join Atmail's Compliance & Trust team.

Work arrangement
Yes