GRC Security Engineer

At RUSH, we design, build, and manage purposeful digital experiences that improve people's lives.
Our clients trust us with their systems and data. Our ISO 27001 certification and PCI DSS compliance are part of how we earn that trust, and it needs to hold up every day, not only when the auditors arrive.
We're looking for a GRC Engineer to own our ISO 27001 and PCI DSS programmes and keep RUSH audit-ready all year round.
You'll run the ISMS, lead client and government assurance work, and set the policies that guide how we build and operate. You'll also bring enough technical depth to check that controls work in practice, and you'll automate evidence collection so audits become a by-product of normal work.
Key accountabilities and responsibilities
Certification and compliance programmes
ISO 27001 ISMS: Run the information security management system, including the risk register, Statement of Applicability, internal audits, management review and surveillance audits.
PCI DSS: Run the annual PCI DSS v4 assessment and keep evidence current through the year.
Evidence automation: Automate evidence collection wherever possible, so audits become a by-product of normal work rather than a seasonal scramble.
Policy and risk
Security policies: Draft and maintain security policies for Hamish to approve, and track exceptions.
Third-party risk: Run third-party and vendor risk reviews.
AI governance: Own AI governance and policy, alongside the Architect's technical controls.
Client and government assurance
Government assurance: Lead NZISM and government assurance work, partnering with the Architect on technical assessments.
Client security requests: Own client security questionnaires, trust packs and the security sections of RFPs.
Security culture
Awareness training: Run security awareness training across RUSH and track completion.
About you
Experience and qualifications
Experience: Around 3 to 5 years in GRC, audit or security compliance.
ISO 27001: Hands-on experience, ideally through at least one certification or surveillance audit.
PCI DSS: Working knowledge of PCI DSS v4.
Nice to have: ISO 27001 Lead Implementer or Lead Auditor, CISA, or NZISM experience.
Technical skills
Enough technical depth to read a cloud configuration or pipeline and judge whether a control is really working.
Experience automating evidence collection or using compliance tooling to monitor controls.
Key competencies
Clear writing: Writes policies, client responses and audit findings that are accurate and easy to act on.
Pragmatism: Right-sizes controls and policies to the risk, so security supports delivery rather than slowing it down.
Stakeholder engagement: Works with engineers, delivery leads, clients and auditors to agree what good looks like and get it done.
Ownership: Keeps programmes moving all year without waiting for an audit deadline.
What we offer
Ownership: Clear ownership of RUSH's ISO 27001 and PCI DSS programmes, with direct access to our CISO.
Impact: The chance to make compliance continuous and largely automated, rather than a yearly scramble.
Breadth: Variety across certification, government assurance, client trust, vendor risk and AI governance.
Flexible working: Parnell Office location and hybrid arrangement

Employment type
Full-Time

Work arrangement
No