About the Organisation

Source's client, PLUS ES is entering an exciting new chapter. As they continue their journey as a leader in metering and data services, they are building smarter infrastructure solutions at the intersection of technology, service and sustainability, powering the energy and resource transition across Australia. This is a rare moment to shape what PLUS ES becomes next, with a steadfast commitment to delivering the reliable, accurate data and insights a sustainable energy future depends on.

PLUS ES’s mission is to deliver smarter infrastructure and data to enable a sustainable tomorrow, and our vision is to keep innovating today for tomorrow's energy challenges. As they evolve, they are doubling down on what makes them who they are: Safety, Team, Customer, Innovation, and Accountability.

About the Role

There is no ISMS to inherit here, no legacy security team to reshape, and a blank page on which you will write the cyber strategy from the first line, protecting infrastructure that underpins the energy transition.

You will secure an estate spanning SAP S/4HANA, Salesforce, Microsoft Azure and Microsoft 365, the Enterprise Data Platform, integration services, customer and partner platforms, and market gateway services, alongside a smart metering ecosystem of head end platforms, telecommunications networks, field mobility solutions and connected meter infrastructure.

You will be building the identity and access model, the governance framework and the incident response playbook at the same time as taking the organisation through ISO 27001 certification, all while sourcing and standing up the managed security provider who will do much of the heavy lifting alongside you.



It is a role that rewards people who are as comfortable in a certification audit as they are chairing the room during a live incident, because in the first eighteen months you will likely do both more than once.

Reporting to the Chief Information Officer, you will be the voice that tells the Board and the Audit and Risk Committee exactly where the organisation's cyber risk sits, and precisely what you are doing about it.

Key Responsibilities

- Define and own the cyber security strategy, target posture and operating model.

- Establish identity and access management, ISO 27001 certification and control evidence as the organisation builds a standalone security capability.

- Establish security operations, vulnerability management, data security and security awareness capabilities, delivered through partnership with specialist providers where appropriate.

- Select, contract and govern managed security service providers and specialist partners.

- Own the security governance, risk and compliance framework, including ISO 27001 certification and regulatory obligations.

- Act as security design authority across cloud, enterprise applications, data and operational technology environments.

- Lead incident response, containment decisions and executive communication during a cyber incident.

About You

With extensive experience in cyber security, including at least three years leading a cyber or information security function,



you will have demonstrated experience establishing an ISO 27001 certified Information Security Management System, from control design through to external audit readiness. You understand the regulatory and assurance obligations of operating in a regulated industry, and you apply recognised frameworks such as ISO 27001, NIST or AESCSF in practice, not just by reference.

You know how to select, contract and transition managed security service providers, and you bring a solid security architecture background across cloud, identity and enterprise applications, including establishing identity and access management capabilities. You are commercially confident, comfortable owning a budget and holding providers accountable for contracted outcomes, and as comfortable leading a live incident response as presenting certification readiness to an audit and risk committee.

Above all, you want to build a function, not inherit one, ideally within a newly established or materially transformed organisation. Experience in energy, utilities, telecommunications or another critical infrastructure industry is a natural fit, along with certifications such as CISSP, CISM or CISA.

Why Apply?

This is a rare opportunity to build and shape a cyber security function from the ground up, with direct accountability for certification, capability and outcomes during a defining period for the business.

How to Apply

If you are an experienced cyber security leader who thrives on ambiguity and enjoys building capability from scratch, we would love to hear from you. Please submit your application, including your resume and a cover letter addressing the key requirements of the role.

This organisation is an equal opportunity employer and welcomes applications from all backgrounds.

📌 Head of Cyber Security (Melbourne)
🏢 Source
📍 Melbourne