This is a 2026 step-by-step pathway guide for a Cyber Governance, Risk and Compliance (GRC) Specialist migrating to Australia under ANZSCO 262114. 262114 is on MLTSSL and CSOL — the full skilled visa stack is open: Subclass 189 Independent, Subclass 190 State-Nominated, Subclass 491 Regional Provisional → 191 PR, Subclass 186 Direct Entry, Subclass 494 Regional Employer → 191, and Subclass 482 Core Skills → 186 TRT.
For the cost / timeline view see the 262114 cost & timeline case study. For ACS document details see the skills assessment guide.
Step 1 — Confirm 262114 is the right code
ANZSCO 262114 covers cyber governance, risk and compliance work — second-line cyber risk management, control framework design (ISO 27001, NIST CSF, Essential Eight), regulatory compliance advisory (APRA CPS 234, Privacy Act, SOCI Act, PCI DSS, SOC 2), audit liaison, and cyber risk reporting to executives / boards. Use ANZSCO search to verify against 262112 ICT Security Specialist (broader advisory), 262117 Cyber Security Architect (architecture), and 261315 Cyber Security Engineer (engineer / build).
If you spend more than half your time hands-on with controls (writing detection, hardening systems), 261315 fits better. If you sit predominantly in second-line risk advisory and audit, 262114 is the right code.
Step 2 — ACS skills assessment
ACS (acs.org.au) assesses ICT qualifications and experience. Pathways:
- Skills Assessment — Major in ICT — bachelor / master ICT- or cybersecurity-aligned + ANZSCO-aligned role: 2 years deducted.
- Skills Assessment — Minor in ICT — partial ICT subjects: 4-5 years deducted.
- RPL — non-ICT-aligned candidates with 6+ years experience. Two project reports required, ideally GRC-focused (one ISO 27001 implementation, one regulated-sector compliance program).
Reference letters must demonstrate risk-and-compliance work rather than generic security operations. Audit findings authored, control framework gap assessments, board-level cyber risk reporting, and CPS 234 / SOCI compliance program leadership are the strongest evidence.
Step 3 — English
EOI lodgement requires Competent English (IELTS 6.0 each / PTE 50 each / OET B). For points-tested visas, target Proficient (IELTS 7.0 each = 10 pts) or Superior (IELTS 8.0 each = 20 pts) — at GRC seniority levels, written communication is half the job, and Superior-tier English shifts you decisively above the 189 cutoff.
Step 4 — Choose a visa pathway
Subclass 189 Independent
Best for senior GRC consultants with 8+ years experience, Superior English, age <33. The 189 invitation rounds for 262114 are competitive but accessible for candidates clearing 90+ points. See Subclass 189.
Subclass 190 State-Nominated
+5 points for state nomination. NSW (Sydney CBD financial services concentration), VIC (Melbourne corporates), and ACT (federal government cyber roles) actively nominate cyber GRC. See Subclass 190 and the state nomination tracker.
Subclass 491 → 191 (regional)
+15 points for regional. Newcastle, Wollongong, Geelong, Adelaide, Hobart, Canberra and Perth are designated regional zones with substantial cyber GRC demand from state government and regional financial services. See Subclass 491.
Subclass 186 Direct Entry
The big-4 banks (CBA, Westpac, ANZ, NAB) sponsor heavily under APRA CPS 234. Insurers (IAG, Suncorp, QBE, Allianz, Medibank) actively hire under CPS 230 (operational risk management). Big-4 consultancies (Deloitte, EY, PwC, KPMG) plus boutique cyber consultancies (CyberCX, Tesserent, Trustwave, Mandiant, NCC Group) sponsor experienced GRC consultants for Australian client work. See Subclass 186.
Subclass 482 → 186 TRT / Subclass 494
482 Core Skills for 4 years employer-tied work, then 186 TRT after 2 years. 494 for 5-year regional sponsorship → 191. See Subclass 482 and Subclass 494.
Step 5 — Score your points
Use the points calculator. Senior GRC consultants with 8+ years skilled employment, Superior English, and partner / dependent claims routinely reach 95-100+ points.
Step 6 — Submit EOI / lodge
Lodge an EOI through SkillSelect for 189/190/491. For 186/494/482, the employer's sponsorship + nomination is lodged first.
Useful tools
- Visa fee calculator
- Document checklist — ACS evidence pack
- Eligibility wizard
- Invitation rounds tracker
- State nomination tracker
Authoritative sources
- Home Affairs — visa pricing
- ACS — Australian Computer Society
- ACSC — Australian Cyber Security Centre
- APRA CPS 234
- Office of MARA
Next step
Want to map your GRC profile against 189 vs 190 vs 491 vs 186 vs 494 vs 482? Book a 30-minute free strategy call.