Cyber Security Lead

Cyber Security Lead

Ready to build a cyber security function from the ground up?

Symphony is looking for a hands-on Cyber Security Lead to be the founding member of our cyber security team. This is a rare, broad role: as our sole security officer you will combine security engineering with governance, risk and compliance (GRC) across both IT and operational technology (OT), with a genuine pathway towards senior cyber leadership as the team grows. You will be well supported in your development as our business grows.

Reporting to the Chief Information and Security Officer (CISO), you will work across security operations, governance, risk, compliance and incident response. You will have the CISO’s backing to establish the processes, structure and governance we need. You will collaborate with technical teams, business leaders and external security partners to protect our systems, information and people. Symphony is a large and dynamic organisation enabling energy transition to renewables and AI factories in Australia, so we are looking for people with an entrepreneurial spirit and a can-do attitude.

This is a predominantly on-site role with some flexibility, based at our Keswick (SA), Melbourne (CBD) or Sydney (CBD) office.

What you will do

• Operate and maintain our Information Security Management System aligned with the ASD Essentials and AESCSF 2.0 frameworks and help us achieve SP2 maturity before the regulatory mandate.

• Ensure security controls operate as defined and work with stakeholders to improve their controls, cyber posture and culture across the business.

• Monitor and respond to cyber security threats and incidents, working closely with our outsourced SOC/MDR provider.

• Identify and manage vulnerabilities to drive practical improvements.

• Engineer, implement and maintain security technologies across IT and OT, endpoint, network and cloud environments, including SASE, managed XDR and attack surface management.

• Secure our email and collaboration platforms through email security and data loss prevention (DLP) controls.

• Apply GRC practices across both IT and OT environments, balancing resilience with operational needs and customer requirements, including responding to security questionnaires and audits.

• Manage cyber security risks and policies, and prepare executive and board reporting with the CISO.

• Govern and oversee external security service providers, including our SOC/MDR provider.

• Deliver security awareness training and phishing, incident response and crisis simulation exercises.

• Provide clear, practical advice across the business, influencing change through collaboration and alignment.

What you will bring

• Proven experience in cyber security or information security, ideally as a security engineer looking to move into governance, compliance and leadership.

• Strong knowledge of security operations, risk and compliance.

• AI-native work practices that deliver high productivity and fast agentic defences, with robust AI governance across our AI-enabled workforce.

• Experience with identity, endpoint, network, secure application development and cloud security.

• Hands-on experience with Palo Alto Prisma Access and Cortex XDR is advantageous, as are equivalent tools from other vendors.

• Microsoft 365 security experience, including Microsoft Purview and other technologies for information protection and data loss prevention.

• Experience securing both IT and OT environments, or a demonstrated ability to build OT knowledge quickly.

• Working knowledge of GRC frameworks such as AESCSF, ISO 27001, IEC 62443, ASD ISM and the ASD Essentials, or a strong drive to learn and apply them pragmatically.

• Confidence responding to cyber incidents and managing vulnerabilities in partnership with other teams and external service providers.

• Strong analytical and problem-solving skills.

• The ability to turn technical risks into clear business advice.

• Willingness and eligibility to undertake an Australian Government NV1 (Negative Vetting Level 1) security clearance.

Qualifications in Cyber Security or Information Technology, relevant industry certifications (such as CISSP, CISM, Security+ or Microsoft security certifications) and experience with Microsoft Azure will be highly regarded.

Who you are

• A self-starter who is outcomes-focused and comfortable operating with a high degree of autonomy and personal accountability.

• A builder who enjoys progressively establishing processes, structure and governance where they are needed.

• An excellent communicator with strong interpersonal, stakeholder engagement, influencing and service-oriented skills.

• Pragmatic and solutions-focused, with a proven ability to drive change through collaboration, alignment and mutually beneficial outcomes rather than authority or mandate.

• Comfortable with ambiguity and competing priorities, and adaptable as the business and the team evolve.

Is this role right for you?

We want to be upfront. This is a foundational role in a growing group of companies. We are still integrating multiple businesses, so processes are not just maturing but being harmonised and consolidated, and you will be expected to create structure rather than inherit it.

We live by Extreme Ownership, Win with Integrity, Safety Always and Make the Complex Simple, and we lead through context, not control. If you need clearly defined processes and formal authority to be effective, this may not be the right fit. If you are energised by ambiguity and drive outcomes through influence and collaboration, we would love to hear from you.

Make your mark

This is an opportunity to build Symphony’s cyber security capability from the ground up, influence security across a growing organisation, and grow with the function as the team expands.

If you are a self-starter, passionate, curious, technically capable and ready to make an impact, apply now!