Offensive Security Lead

Through purpose and people - not just through the infrastructure we operate, but through the way we show up for each other, our customers’ and our communities. The future of energy is in our hands. Let’s shape it together.

Are you ready to shape the future of energy?

This is a great opportunity for someone who wants to work in critical infrastructure, leading a team of experts in implementing vital policies and establishing and leading Aus Net’s Offensive Security capability.

We are looking for an Offensive Security Lead to ensure security controls are continuously assessed against current and emerging threats, driving risk informed remediation and improving the organisation’s cyber resilience through continuous security testing and secure development practices.

The Offensive Security Lead is responsible for establishing and leading Aus Net’s Offensive Security capability, providing strategic and technical leadership across penetration testing, red teaming, application security and exposure management to proactively identify, validate and reduce cyber security risk across IT and OT, cloud platforms and applications.

As the technical authority for Offensive Security, the role balances hands‑on technical leadership with people leadership, vendor management and strategic planning to ensure security assurance activities deliver measurable reductions in organisational cyber risk.

• Lead and oversee the organisation’s penetration testing, red teaming and adversary emulation program, validating the effectiveness of preventative, detective and responsive security controls across IT, OT, cloud and critical business applications.
• Have accountability of day‑to‑day operational outcomes of the function, as well as developing and driving the strategic direction, aligning people and processes to achieve business and cyber department goals.
• Own the Exposure Management capability, including vulnerability management, security validation and remediation governance, ensuring security risks are accurately prioritised, effectively communicated and remediated within agreed risk tolerances.
• Lead the Application Security function by embedding security‑by‑design principles throughout the software development lifecycle, providing security guidance, code reviews, testing and developer enablement to reduce software security risk.
• Develop and maintain an intelligence‑led offensive security program, leveraging threat intelligence, adversary tradecraft and frameworks such as MITRE ATT&CK to continuously evolve testing methodologies and emulate relevant threat actors.
• Technical hands‑on red teaming and penetration testing as required, complementing the work provided by our partners.
• Establish and maintain a differentiated OT security testing methodology, ensuring all penetration testing, red teaming and adversary emulation activity against OT/ICS environments follows a safety‑first, non‑disruptive approach appropriate to live operational technology. This includes defining clear boundaries between passive and active testing techniques, determining where live‑fire testing is and isn’t permitted on production OT assets, and establishing mandatory coordination and sign‑off with OT Engineering and Asset Management teams prior to any testing activity that could impact operational safety or grid reliability.
• Partner with Cyber Defence, Network Security, OT Security, Enterprise Architecture, IAM, GRC and technology delivery teams to validate security controls, improve detection capabilities through purple team activities and strengthen the organisation’s overall cyber resilience.
• Lead the management of third‑party security service providers, including penetration testing, application security and vulnerability management partners, ensuring contractual obligations, service levels and quality standards are consistently achieved.
• Liaise with external entities, such as cybersecurity advisory bodies, threat intelligence entities, law enforcement agencies, and external partners, to maintain a strong security posture and stay ahead of relevant security threats.
• Provide authoritative technical advice and risk‑based…