Cyber Security Lead (Product & Corporate) - Abbotsford, VIC, Australia

Salary: $150,000 – $165,000 base + super

Location: Melbourne (Hybrid)

Type: Full time (part time considered)

About Allume

We're empowering millions of people to access clean, affordable energy.

We're a Melbourne-based technology company, and our world-first technology, SolShare, unlocks rooftop solar for apartment residents. This smart hardware connects a single rooftop solar system to multiple units and common areas, fairly distributing solar energy so everyone gets their fair share. SolShare helps reduce both energy bills and carbon emissions.

SolShare removes the technical and ownership barriers that have long prevented apartment households from accessing rooftop solar. We built it here in Melbourne, and it's now connected over 13,000 apartments across Australia, the UK and the US. We're doubling our installation base each year, and we're aiming to connect over 100,000 apartments by 2029. SolShare now also brings shared battery optimisation to apartment buildings.

We're growing quickly, and our technology is becoming more capable as we scale. That means we need great people to help us build what comes next.

Our commitment to diversity and inclusion

Allume is an endorsed employer for women by WORK180, and you can find a full list of our benefits and policies here: https://work180.com/en-au/for-women/employer/allume-energy

We believe diverse perspectives are the key to better outcomes. We welcome applications from people of all genders, ages, nationalities, abilities and cultures, and we’re committed to an inclusive workplace where everyone can do their best work.

If you need any adjustments or flexibility to take part fully in our recruitment process, tell us when you apply and we’ll support you.

What we offer

• Hybrid work: You’ll be based in our Melbourne office, with the flexibility to work from home. We get a lot out of face-to-face time, so we look forward to seeing you in the office regularly.
• Flexibility: We’d prefer this role to be full time, but if you’re returning to work or want more time for life outside it, we’d still love you to apply. Part-time looks different for everyone, and we’re happy to talk about what would suit you.
• Leave and Half-Day Fridays: 25 days (5 weeks) of annual leave, plus a ‘Half-Day Friday’ every fortnight when the whole team logs off at lunch.
• Progressive parental leave: 15 weeks paid leave for primary carers and 5 weeks for secondary carers, with no minimum tenure.
• Wellbeing: Free, confidential counselling and support through our Employee Assistance Program.
• Options: Share options through our Employee Share Option Plan (ESOP).

About the role

You'll own security across Allume – our corporate systems, our SolShare technology and the AWS cloud platform behind it. SolShare is smart hardware that routes solar energy between apartments while streaming data to the cloud, so keeping it secure means keeping a physical energy system safe and trusted.

Most of your focus will be product security: evolving SolShare to meet requirements such as ETSI EN 303 645 and the EU Cyber Resilience Act, while maintaining our existing market obligations. You'll also lead the business to ISO/IEC 27001 certification, starting from a roadmap set by an independent risk assessment, and owning our security governance.

Our security needs are evolving as we scale and enter new markets. Reporting to our Head of Systems and Integration, you'll set the direction and make risk-based calls, working with them, our Head of Operations, our Head of Embedded Software and our cloud team, who'll build and run the defined controls.

What you’ll do

Product security

• Own our product security roadmap, including ETSI EN 303 645 and the EU Cyber Resilience Act as its harmonised standards are finalised.
• Keep us compliant with the applicable market regulations, including the UK Product Security and Telecommunications Infrastructure (PSTI) Act and Australia’s Cyber Security Act 2024.
• Turn standards into clear, testable requirements for our hardware, firmware and cloud developers, then review designs and evidence against them.
• Lead threat modelling for SolShare, from secure boot and firmware updates to device identity and the commands that control energy routing.
• Own vulnerability disclosure and security incident response, including reporting to regulators in each market.
• Mentor our developers, and bring in external specialists such as penetration testers or test labs when we need them.

Cloud and corporate security

• Build security into our cloud and device connectivity by default, working with our cloud team, and be our AWS security authority.
• Own the creation of practical security policies and standards for corporate IT, cloud and devices, working with the right people to write them.

Governance, risk and privacy

• Lead us to ISO/IEC 27001 certification and keep it current.
• Own our risk register and report security risk to the executive team.
• Manage security for our suppliers and SolShare installation partners, including setting clear expectations.
• Make sure our security controls support our privacy obligations under the Australian Privacy Act, UK GDPR and EU GDPR, and bring in legal or privacy advice when it helps.

What we’re looking for

We’re looking for someone who sees security as a way to help Allume move forward and build trust, not slow us down. You bring calm, focused energy to the team, and you design security that grows with us.

You'll bring:

• Solid experience across cyber security, compliance or risk, including hands-on exposure to IoT, embedded or connected product security.
• Experience turning security standards into technical requirements engineers can build and test against.
• Working knowledge of threat modelling, secure boot, firmware signing and update, and vulnerability management.
• Cloud security depth (ideally AWS), plus identity and endpoint security.
• Experience leading or contributing to ISO/IEC 27001 certification.
• Experience with incident response, and reporting risk to executives in clear, plain language.

Highly regarded:

• ETSI EN 303 645, EN 18031, UK PSTI, Australia’s Cyber Security Act 2024 or EU Cyber Resilience Act experience, or CE, UKCA or RCM conformity.
• Energy, utilities, critical infrastructure or operational technology security (such as IEC 62443).
• Privacy and data protection experience (e.g. GDPR, Australian Privacy Act), or CIPP certification.
• Certifications such as ISO 27001 Lead Implementer, CISSP, CISM or AWS Certified Security – Specialty.

Right to work

You’ll need valid, unrestricted work rights in Australia. We can’t offer visa sponsorship.

Interview process

Our process has three stages over four to six weeks:

• Round 1: Online interview (15 minutes) – a short conversation about your experience, what you’re looking for and why Allume interests you.
• Round 2: Security compliance deep dive (1 hour) – an in-person discussion with the hiring manager to explore your expertise.
• Round 3: Values and team alignment (1.5 hours) – a final conversation with the hiring manager and the wider team, so both sides can work out whether Allume is the right fit.

Ready to apply?

Apply via the link and tell us why this role interests you. We’d love to hear from you.