Senior GRC Specialist
for sections like About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Only include sections if there is real specific content.
We need to parse the job description.
Content:
- Who Are We: description of Hansen Technologies. Could be "About the role"? Actually "About the role" is typical heading. But the description includes "Who Are We" and "Why This Role Matters". We can combine into an "About the role" section maybe. The instruction: use for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). So we should use those exact headings if we have content.
We need to decide which sections we have content for.
We have:
- About the role: could include "Who Are We Hansen Technologies..." and "Why This Role Matters". That's substantive.
- Responsibilities: the "What You’ll Do" bullet list.
- Requirements/Qualifications/Skills: The "What You Bring" and "You’re Someone Who (may) Have Experience...". Could be considered qualifications/skills. We need to separate maybe into Requirements and Skills. But we can combine into one section if we want fewer sections. The instruction: Prefer a few substantive sections over many thin ones. So we could have About the role, Responsibilities, Requirements (including qualifications and skills). Possibly Benefits? The posting includes "Why Join Us?" which describes culture, values, etc. That could be Benefits? Actually benefits are not listed; it's more about culture. There's no explicit benefits, pay, schedule. So we should not create Benefits, Pay, Schedule sections unless they have real specific content. There's no mention of pay or schedule. So we omit those.
Thus sections: About the role, Responsibilities, Requirements (or Qualifications). We'll use for each.
We need to use - for any list of duties/requirements/benefits. So for Responsibilities we need a list. For Requirements we need a list.
We need to preserve all substantive information, not invent or summarize away detail. Remove boilerplate: cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, and application instructions. So we need to strip out "Contact Us", "If you possess the desired skills and enthusiasm, please “Apply Now” via the link or visit our career page.", "We are an equal opportunity employer...", "Visit our website at hansencx.com for more information.", "Data Privacy Notice..." etc.
Also remove duplicated lines.
We need to keep the substantive content: Who Are We, Why This Role Matters, What You’ll Do (list), What You Bring (list), You’re Someone Who (may) Have Experience (list). Possibly combine What You Bring and You’re Someone Who into Requirements.
We must not repeat the job title as a heading. The job title is not given explicitly but maybe "security GRC professional". We'll not add heading.
We need to output only HTML fragment, no /, no markdown fences.
Let's extract content.
Who Are We:
"Hansen Technologies (ASX: HSN) is a global software and services provider, serving energy, water/utilities, and telecommunications industries. With customers in 80+ countries, we foster collaboration across 26 global offices. From 5G advancements to renewable energy transitions, we empower customers to overcome challenges, innovate, and drive new business models. At Hansen, we are also embedding AI enablement across our operations. From automating workflows and enhancing service delivery, to driving innovation in customer solutions, AI is shaping the next chapter of how we support our clients. With a focus on operational excellence and innovation, Hansen is using AI not just as a tool, but as a strategic enabler to deliver smarter, faster, and more resilient solutions for the future. This is full -time onsite role based in our Bethlehem office."
Why This Role Matters:
"At Hansen, we're looking for a hands-on, high-impact security GRC professional to help us scale and mature our governance, risk, and compliance practices globally. You’ll design, implement, and evolve security governance initiatives, drive data protection efforts, own business continuity readiness, and be a visible force for change across the organisation. This is a rare opportunity to blend autonomy, innovation, and execution in a role that touches every corner of the business. We’re looking for a builder, a strategic problem-solver, and a passionate security evangelist who thrives on making security integral to how we work."
We can combine these two paragraphs into About the role.
Now Responsibilities (What You’ll Do):
List items:
- Risk Management: Lead and conduct cybersecurity risk assessments aligned with Hansen’s risk framework, identifying key findings and treatment actions. Ensure all risks related to security controls are documented, tracked, and remediated with accountability. Communicate risk status and third-party assessment outcomes to relevant stakeholders.
- Governance & Compliance: Develop, maintain, and enforce security policies and standards aligned with ISO 27001, SOC, NIST, and regulatory requirements. Support internal and external audits, certifications, and compliance monitoring, ensuring controls operate effectively and remediation is followed up.
- Information Security Management System (ISMS): Operate and continuously improve the ISMS, maintaining governance documentation, risk registers, and management reporting to meet audit and regulatory expectations.
- Data Protection & Identity Management: Implement and monitor data protection controls, conduct regular user access reviews to ensure least privilege, and validate that security mechanisms are correctly configured and effective.
- Security Awareness: Lead security awareness programs and campaigns to build a strong security culture across the organisation, engaging stakeholders and measuring impact.
- Incident Response & Resilience Readiness: Maintain and test the incident response plan through simulations and exercises. Own the Business Continuity and Disaster Recovery (BCP/DR) planning, coordinating regular testing and improvements to ensure organisational resilience.
- Stakeholder & Third-Party Risk Management: Engage with internal teams, external auditors, regulators, and third-party vendors to manage cybersecurity risks, provide assurance, and oversee third-party security performance.
- Governance & Reporting: Support and optimise GRC toolsets for risk tracking, control monitoring, and reporting. Produce clear and actionable management information for leadership and regulatory submissions.
Now Requirements / Skills:
What You Bring:
- Strong background in hands-on security governance, risk management, and compliance delivery.
- Proven experience implementing and managing technical and administrative data protection controls.
- Working knowledge of key frameworks (ISO 27001, NIST, GDPR, SOC2, ITGC, etc.).
- Experience leading BCP/DR programs and running real or simulated incident response scenarios.
- Exceptional communication skills - you can translate control language into business impact and vice versa.
- Past experience driving security awareness programs and influencing behaviour across departments.
- Demonstrated ability to self-start, self-direct, and innovate in ambiguous environments.
You’re Someone Who (may) Have Experience in a similar role working in the technology industry.
- Conducted Incident Response Tests and developed scenarios
- Configured data protection or data loss prevention controls in corporate IT environments.
We can combine these into a list.
We need to ensure we don't include filler like "may". Keep as is.
Now we need to output HTML.
Structure:
About the role
... combined paragraphs ...
Responsibilities
- ...
...
Requirements
- ...
...
We should not include any other sections.
Make sure to preserve all details exactly as in the text, but we can combine sentences? The instruction: Preserve ALL substantive information; do NOT invent or summarize away detail. So we should not omit any detail. We can keep the sentences as they are, maybe combine into paragraphs but not lose any info. For About the role we have two paragraphs; we can keep them as separate tags or one
with both. Safer to put them in one
but ensure we keep all content. We'll combine with a space.
Let's craft About the role paragraph:
"Hansen Technologies (ASX: HSN) is a global software and services provider, serving energy, water/utilities, and telecommunications industries. With customers in 80+ countries, we foster collaboration across 26 global offices. From 5G advancements to renewable energy transitions, we empower customers to overcome challenges, innovate, and drive new business models. At Hansen, we are also embedding AI enablement across our operations. From automating workflows and enhancing service delivery, to driving innovation in customer solutions, AI is shaping the next chapter of how we support our clients. With a focus on operational excellence and innovation, Hansen is using AI not just as a tool, but as a strategic enabler to deliver smarter, faster, and more resilient solutions for the future. This is full -time onsite role based in our Bethlehem office. At Hansen, we're looking for a hands-on, high-impact security GRC professional to help us scale and mature our governance, risk, and compliance practices globally. You’ll design, implement, and evolve security governance initiatives, drive data protection efforts, own business continuity readiness, and be a visible force for change across the organisation. This is a rare opportunity to blend autonomy, innovation, and execution in a role that touches every corner of the business. We’re looking for a builder, a strategic problem-solver, and a passionate security evangelist who thrives on making security integral to how we work."
Check for any duplicated lines: none.
Now Responsibilities list: each bullet as given.
We need to ensure we keep the exact phrasing.
Let's copy each bullet:
1. "Risk Management: Lead and conduct cybersecurity risk assessments aligned with Hansen’s risk framework, identifying key findings and treatment actions. Ensure all risks related to security controls are documented, tracked, and remediated with accountability. Communicate risk status and third-party assessment outcomes to relevant stakeholders."
2. "Governance & Compliance: Develop, maintain, and enforce security policies and standards aligned with ISO 27001, SOC, NIST, and regulatory requirements. Support internal and external audits, certifications, and compliance monitoring, ensuring controls operate effectively and remediation is followed up."
3. "Information Security Management System (ISMS): Operate and continuously improve the ISMS, maintaining governance documentation, risk registers, and management reporting to meet audit and regulatory expectations."
4. "Data Protection & Identity Management: Implement and monitor data protection controls, conduct regular user access reviews to ensure least privilege, and validate that security mechanisms are correctly configured and effective."
5. "Security Awareness: Lead security awareness programs and campaigns to build a strong security culture across the organisation, engaging stakeholders and measuring impact."
6. "Incident Response & Resilience Readiness: Maintain and test the incident response plan through simulations and exercises. Own the Business Continuity and Disaster Recovery (BCP/DR) planning, coordinating regular testing and improvements to ensure organisational resilience."
7. "Stakeholder & Third-Party Risk Management: Engage with internal teams, external auditors, regulators, and third-party vendors to manage cybersecurity risks, provide assurance, and oversee third-party security performance."
8. "Governance & Reporting: Support and optimise GRC toolsets for risk tracking, control monitoring, and reporting. Produce clear and actionable management information for leadership and regulatory submissions."
Now Requirements list:
Combine What You Bring and You’re Someone Who.
List items:
- "Strong background in hands-on security governance, risk management, and compliance delivery."
- "Proven experience implementing and managing technical and administrative data protection controls."
- "Working knowledge of key frameworks (ISO 27001, NIST, GDPR, SOC2, ITGC, etc.)."
- "Experience leading BCP/DR programs and running real or simulated incident response scenarios."
- "Exceptional communication skills - you can translate control language into business impact and vice versa."
- "Past experience driving security awareness programs and influencing behaviour across departments."
- "Demonstrated ability to self-start, self-direct, and innovate in ambiguous
for each.
We need to use - for any list of duties/requirements/benefits. So for Responsibilities we need a list. For Requirements we need a list.
We need to preserve all substantive information, not invent or summarize away detail. Remove boilerplate: cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, and application instructions. So we need to strip out "Contact Us", "If you possess the desired skills and enthusiasm, please “Apply Now” via the link or visit our career page.", "We are an equal opportunity employer...", "Visit our website at hansencx.com for more information.", "Data Privacy Notice..." etc.
Also remove duplicated lines.
We need to keep the substantive content: Who Are We, Why This Role Matters, What You’ll Do (list), What You Bring (list), You’re Someone Who (may) Have Experience (list). Possibly combine What You Bring and You’re Someone Who into Requirements.
We must not repeat the job title as a heading. The job title is not given explicitly but maybe "security GRC professional". We'll not add heading.
We need to output only HTML fragment, no /, no markdown fences.
Let's extract content.
Who Are We:
"Hansen Technologies (ASX: HSN) is a global software and services provider, serving energy, water/utilities, and telecommunications industries. With customers in 80+ countries, we foster collaboration across 26 global offices. From 5G advancements to renewable energy transitions, we empower customers to overcome challenges, innovate, and drive new business models. At Hansen, we are also embedding AI enablement across our operations. From automating workflows and enhancing service delivery, to driving innovation in customer solutions, AI is shaping the next chapter of how we support our clients. With a focus on operational excellence and innovation, Hansen is using AI not just as a tool, but as a strategic enabler to deliver smarter, faster, and more resilient solutions for the future. This is full -time onsite role based in our Bethlehem office."
Why This Role Matters:
"At Hansen, we're looking for a hands-on, high-impact security GRC professional to help us scale and mature our governance, risk, and compliance practices globally. You’ll design, implement, and evolve security governance initiatives, drive data protection efforts, own business continuity readiness, and be a visible force for change across the organisation. This is a rare opportunity to blend autonomy, innovation, and execution in a role that touches every corner of the business. We’re looking for a builder, a strategic problem-solver, and a passionate security evangelist who thrives on making security integral to how we work."
We can combine these two paragraphs into About the role.
Now Responsibilities (What You’ll Do):
List items:
- Risk Management: Lead and conduct cybersecurity risk assessments aligned with Hansen’s risk framework, identifying key findings and treatment actions. Ensure all risks related to security controls are documented, tracked, and remediated with accountability. Communicate risk status and third-party assessment outcomes to relevant stakeholders.
- Governance & Compliance: Develop, maintain, and enforce security policies and standards aligned with ISO 27001, SOC, NIST, and regulatory requirements. Support internal and external audits, certifications, and compliance monitoring, ensuring controls operate effectively and remediation is followed up.
- Information Security Management System (ISMS): Operate and continuously improve the ISMS, maintaining governance documentation, risk registers, and management reporting to meet audit and regulatory expectations.
- Data Protection & Identity Management: Implement and monitor data protection controls, conduct regular user access reviews to ensure least privilege, and validate that security mechanisms are correctly configured and effective.
- Security Awareness: Lead security awareness programs and campaigns to build a strong security culture across the organisation, engaging stakeholders and measuring impact.
- Incident Response & Resilience Readiness: Maintain and test the incident response plan through simulations and exercises. Own the Business Continuity and Disaster Recovery (BCP/DR) planning, coordinating regular testing and improvements to ensure organisational resilience.
- Stakeholder & Third-Party Risk Management: Engage with internal teams, external auditors, regulators, and third-party vendors to manage cybersecurity risks, provide assurance, and oversee third-party security performance.
- Governance & Reporting: Support and optimise GRC toolsets for risk tracking, control monitoring, and reporting. Produce clear and actionable management information for leadership and regulatory submissions.
Now Requirements / Skills:
What You Bring:
- Strong background in hands-on security governance, risk management, and compliance delivery.
- Proven experience implementing and managing technical and administrative data protection controls.
- Working knowledge of key frameworks (ISO 27001, NIST, GDPR, SOC2, ITGC, etc.).
- Experience leading BCP/DR programs and running real or simulated incident response scenarios.
- Exceptional communication skills - you can translate control language into business impact and vice versa.
- Past experience driving security awareness programs and influencing behaviour across departments.
- Demonstrated ability to self-start, self-direct, and innovate in ambiguous environments.
You’re Someone Who (may) Have Experience in a similar role working in the technology industry.
- Conducted Incident Response Tests and developed scenarios
- Configured data protection or data loss prevention controls in corporate IT environments.
We can combine these into a list.
We need to ensure we don't include filler like "may". Keep as is.
Now we need to output HTML.
Structure:
About the role
... combined paragraphs ...
Responsibilities
- ...
...
Requirements
- ...
...
We should not include any other sections.
Make sure to preserve all details exactly as in the text, but we can combine sentences? The instruction: Preserve ALL substantive information; do NOT invent or summarize away detail. So we should not omit any detail. We can keep the sentences as they are, maybe combine into paragraphs but not lose any info. For About the role we have two paragraphs; we can keep them as separate tags or one
with both. Safer to put them in one
but ensure we keep all content. We'll combine with a space.
Let's craft About the role paragraph:
"Hansen Technologies (ASX: HSN) is a global software and services provider, serving energy, water/utilities, and telecommunications industries. With customers in 80+ countries, we foster collaboration across 26 global offices. From 5G advancements to renewable energy transitions, we empower customers to overcome challenges, innovate, and drive new business models. At Hansen, we are also embedding AI enablement across our operations. From automating workflows and enhancing service delivery, to driving innovation in customer solutions, AI is shaping the next chapter of how we support our clients. With a focus on operational excellence and innovation, Hansen is using AI not just as a tool, but as a strategic enabler to deliver smarter, faster, and more resilient solutions for the future. This is full -time onsite role based in our Bethlehem office. At Hansen, we're looking for a hands-on, high-impact security GRC professional to help us scale and mature our governance, risk, and compliance practices globally. You’ll design, implement, and evolve security governance initiatives, drive data protection efforts, own business continuity readiness, and be a visible force for change across the organisation. This is a rare opportunity to blend autonomy, innovation, and execution in a role that touches every corner of the business. We’re looking for a builder, a strategic problem-solver, and a passionate security evangelist who thrives on making security integral to how we work."
Check for any duplicated lines: none.
Now Responsibilities list: each bullet as given.
We need to ensure we keep the exact phrasing.
Let's copy each bullet:
1. "Risk Management: Lead and conduct cybersecurity risk assessments aligned with Hansen’s risk framework, identifying key findings and treatment actions. Ensure all risks related to security controls are documented, tracked, and remediated with accountability. Communicate risk status and third-party assessment outcomes to relevant stakeholders."
2. "Governance & Compliance: Develop, maintain, and enforce security policies and standards aligned with ISO 27001, SOC, NIST, and regulatory requirements. Support internal and external audits, certifications, and compliance monitoring, ensuring controls operate effectively and remediation is followed up."
3. "Information Security Management System (ISMS): Operate and continuously improve the ISMS, maintaining governance documentation, risk registers, and management reporting to meet audit and regulatory expectations."
4. "Data Protection & Identity Management: Implement and monitor data protection controls, conduct regular user access reviews to ensure least privilege, and validate that security mechanisms are correctly configured and effective."
5. "Security Awareness: Lead security awareness programs and campaigns to build a strong security culture across the organisation, engaging stakeholders and measuring impact."
6. "Incident Response & Resilience Readiness: Maintain and test the incident response plan through simulations and exercises. Own the Business Continuity and Disaster Recovery (BCP/DR) planning, coordinating regular testing and improvements to ensure organisational resilience."
7. "Stakeholder & Third-Party Risk Management: Engage with internal teams, external auditors, regulators, and third-party vendors to manage cybersecurity risks, provide assurance, and oversee third-party security performance."
8. "Governance & Reporting: Support and optimise GRC toolsets for risk tracking, control monitoring, and reporting. Produce clear and actionable management information for leadership and regulatory submissions."
Now Requirements list:
Combine What You Bring and You’re Someone Who.
List items:
- "Strong background in hands-on security governance, risk management, and compliance delivery."
- "Proven experience implementing and managing technical and administrative data protection controls."
- "Working knowledge of key frameworks (ISO 27001, NIST, GDPR, SOC2, ITGC, etc.)."
- "Experience leading BCP/DR programs and running real or simulated incident response scenarios."
- "Exceptional communication skills - you can translate control language into business impact and vice versa."
- "Past experience driving security awareness programs and influencing behaviour across departments."
- "Demonstrated ability to self-start, self-direct, and innovate in ambiguous
About the role
... combined paragraphs ...
Responsibilities
- ... ...
Requirements
- ... ...
tags or one
with both. Safer to put them in one
but ensure we keep all content. We'll combine with a space. Let's craft About the role paragraph: "Hansen Technologies (ASX: HSN) is a global software and services provider, serving energy, water/utilities, and telecommunications industries. With customers in 80+ countries, we foster collaboration across 26 global offices. From 5G advancements to renewable energy transitions, we empower customers to overcome challenges, innovate, and drive new business models. At Hansen, we are also embedding AI enablement across our operations. From automating workflows and enhancing service delivery, to driving innovation in customer solutions, AI is shaping the next chapter of how we support our clients. With a focus on operational excellence and innovation, Hansen is using AI not just as a tool, but as a strategic enabler to deliver smarter, faster, and more resilient solutions for the future. This is full -time onsite role based in our Bethlehem office. At Hansen, we're looking for a hands-on, high-impact security GRC professional to help us scale and mature our governance, risk, and compliance practices globally. You’ll design, implement, and evolve security governance initiatives, drive data protection efforts, own business continuity readiness, and be a visible force for change across the organisation. This is a rare opportunity to blend autonomy, innovation, and execution in a role that touches every corner of the business. We’re looking for a builder, a strategic problem-solver, and a passionate security evangelist who thrives on making security integral to how we work." Check for any duplicated lines: none. Now Responsibilities list: each bullet as given. We need to ensure we keep the exact phrasing. Let's copy each bullet: 1. "Risk Management: Lead and conduct cybersecurity risk assessments aligned with Hansen’s risk framework, identifying key findings and treatment actions. Ensure all risks related to security controls are documented, tracked, and remediated with accountability. Communicate risk status and third-party assessment outcomes to relevant stakeholders." 2. "Governance & Compliance: Develop, maintain, and enforce security policies and standards aligned with ISO 27001, SOC, NIST, and regulatory requirements. Support internal and external audits, certifications, and compliance monitoring, ensuring controls operate effectively and remediation is followed up." 3. "Information Security Management System (ISMS): Operate and continuously improve the ISMS, maintaining governance documentation, risk registers, and management reporting to meet audit and regulatory expectations." 4. "Data Protection & Identity Management: Implement and monitor data protection controls, conduct regular user access reviews to ensure least privilege, and validate that security mechanisms are correctly configured and effective." 5. "Security Awareness: Lead security awareness programs and campaigns to build a strong security culture across the organisation, engaging stakeholders and measuring impact." 6. "Incident Response & Resilience Readiness: Maintain and test the incident response plan through simulations and exercises. Own the Business Continuity and Disaster Recovery (BCP/DR) planning, coordinating regular testing and improvements to ensure organisational resilience." 7. "Stakeholder & Third-Party Risk Management: Engage with internal teams, external auditors, regulators, and third-party vendors to manage cybersecurity risks, provide assurance, and oversee third-party security performance." 8. "Governance & Reporting: Support and optimise GRC toolsets for risk tracking, control monitoring, and reporting. Produce clear and actionable management information for leadership and regulatory submissions." Now Requirements list: Combine What You Bring and You’re Someone Who. List items: - "Strong background in hands-on security governance, risk management, and compliance delivery." - "Proven experience implementing and managing technical and administrative data protection controls." - "Working knowledge of key frameworks (ISO 27001, NIST, GDPR, SOC2, ITGC, etc.)." - "Experience leading BCP/DR programs and running real or simulated incident response scenarios." - "Exceptional communication skills - you can translate control language into business impact and vice versa." - "Past experience driving security awareness programs and influencing behaviour across departments." - "Demonstrated ability to self-start, self-direct, and innovate in ambiguous