Senior Analyst - Cyber Security Testing

Australian Energy Market Operator; City of Melbourne; Hybrid; AUD 150,000 - 190,000; Full time

Benefits offered by this job

Flexible working

Professional development

Volunteering leave

Annual performance bonuses

Wellness program

Job summary

Australian Energy Market Operator (AEMO) is seeking a senior security testing professional to lead scoping and delivery of testing across applications, infrastructure and cloud. You will guide adversary-driven testing, vulnerability assessments and remediation strategies while collaborating with internal teams and external partners.

Eligible candidates must possess offensive security certifications and demonstrable experience across web, API, network, cloud and mobile environments, with strong

Qualifications

• Offensive security certifications such as OSCP or equivalent.
• Ability to lead end-to-end scoping and delivery of testing.
• Experience across web apps, APIs, networks, cloud, and mobile apps.
• Strong understanding of adversary tradecraft and risk-based prioritisation.

Responsibilities

• Lead scoping of testing engagements with asset owners and stakeholders.
• Perform hands-on security testing and report vulnerabilities with remediation guidance.
• Test internally adopted and developed tooling for security posture checks.
• Peer review test scopes and reports for technical accuracy and consistency.
• Develop and maintain testing processes and playbooks.

Skills

Offensive security certs

Threat modeling

Vulnerability management

Adversary emulation

MITRE ATT&CK

Job description

Australian Energy Market Operator – Melbourne VIC

AEMO is Australia’s independent energy system and market operator and system planner. AEMO’s purpose is to ensure safe, reliable and affordable energy today, and enable the energy transition for the benefit of all Australians. Australian governments are now committed to a net zero economy for Australia by 2050 and our vision is to enable this. We have the once-in-a-lifetime opportunity to co-design the future of our energy systems, and our core values revolve around character, commitment, and connection. Join us as we contribute to this significant transition in the energy sector.

About the role

AEMO’s Cyber Defence team safeguards critical energy systems and market operations from advanced and emerging cyber threats. The team proactively identifies, assesses, and mitigates cyber risks through security testing, adversary emulation, threat intelligence, and vulnerability management. Further, Cyber Defence monitors, detects, and responds to incidents to protect operational integrity and continuity of critical IT systems.

The team collaborates closely with Australian Government agencies and energy-sector bodies to uplift collective critical infrastructure security and partners with internal technology, engineering, and digital teams to embed secure-by-design practices and deliver cyber engineering and automation solutions. Together, these capabilities ensure AEMO remains secure, resilient, and well-prepared in a rapidly evolving threat landscape.

As a senior member of the Cyber Testing and Vulnerability Management team, you will lead the scoping and delivery of security testing across applications, infrastructure and cloud, including research-based testing of internally adopted and developed tooling. You will lift the capability of the testing function through peer review, playbook development and guidance to analysts, advise the vulnerability management and risk teams, assess complex vulnerability exceptions, and support incident response on an on-call rotation.

The location of this role is flexible.

Please note that to be eligible for this role you require Australian citizenship and the ability to obtain and maintain a national security clearance.

What you will be doing

• Lead the scoping of testing engagements across AEMO, liaising with asset owners and stakeholders to define engagement boundaries, objectives and requirements.
• Conduct hands‑on security testing across scoped engagements, identifying, validating and clearly reporting vulnerabilities with practical remediation guidance.
• Conduct research-driven testing of internally adopted and internally developed tooling, assessing the security posture of new and emerging technology before and after it is brought into the environment.
• Peer review test scopes and reports authored by other testers to maintain technical accuracy and consistency across the team.
• Develop and maintain testing processes and playbooks for use by the testing team.

What you will bring to the role

Experience and Knowledge

• One or more recognised offensive security certifications. OSCP (or equivalent) is desirable.
• Demonstrated ability to lead the scoping and delivery of testing engagements end to end, from defining objectives with asset owners through to reporting and remediation guidance.
• Proven offensive testing capability across several of the following: web applications, APIs, internal and external network infrastructure, Active Directory attack paths, cloud environments (Microsoft Azure), and thick-client or mobile applications.
• Strong understanding of adversary tradecraft and adversary emulation models such as MITRE ATT&CK.
• Vulnerability management experience, including risk‑based prioritisation and the technical assessment of vulnerability exception requests.

In return some of our benefits to you

• Flexible working: work from home, part time,job share, hybrid options,and additional leave options
• Professional development via projects, industry networks,job rotation, study assistance and more.
• Give back with up to 4 days of volunteering leave per year.
• Reward your hard work with annual performance bonuses (subject to eligibility).
• Embrace a healthier you with our wellness program, discounted health insurance, gym perks and our comprehensive Employee Assistance Program (EAP).

About Our Process

At AEMO we are committed to creating a diverse and inclusive workforce. We welcome people of all backgrounds, including people with disabilities and neurodivergence and those who identify as Aboriginal and/or Torres Strait Islander. If you have any accessibility requirements to support you during the application or interview process, simply let us know by emailing us at ******@aemo.com.au