How to apply for Head of Security (f/m/d)

About 1KOMMA5°

1KOMMA5° builds a virtual power plant that connects solar, batteries, heat pumps, and e-mobility into one system controlled by Heartbeat AI. The company's goal is to move 1.5 million households to renewable energy by 2030. It has over 3,000 employees across more than 80 locations, from Finland to Australia.

About the role

This role is the security owner for Heartbeat AI GmbH, the software company for the 1KOMMA5° group. You lead Team Trust inside the Core Platforms domain and act as the main security contact for the technology organisation and the wider group. The job is not only about protecting data centres; it covers security for an energy system that connects hardware, software, and the electricity market in real time.

A typical day

A typical day could involve leading Team Trust, meeting with product and engineering teams in the Core Platforms domain, and answering security questions from across the 1KOMMA5° group. You would also review security for systems that connect solar, batteries, heat pumps, and e-mobility to the electricity market. The role is remote, so much of the work happens over video calls and written communication.

Who 1KOMMA5° is looking for

• Experience leading a security team, ideally in a software or platform company.
• Background in securing systems that combine cloud infrastructure, operational technology, or real-time data flows.
• Ability to act as a security owner across a technology organisation and communicate with non-security stakeholders.
• Interest in the energy transition and in securing a virtual power plant that controls solar, batteries, heat pumps, and e-mobility.

Tips for this application

• Read the 1KOMMA5° and Heartbeat AI descriptions on their website and refer to the virtual power plant and Heartbeat AI by name in your application.
• Explain how your security leadership experience applies to a company that connects hardware, software, and the electricity market, not just data centres.
• Name the security domains you have owned, such as cloud security, application security, or OT security, and give examples of teams you have led.
• Mention that you understand the difference between protecting a software platform and protecting an integrated energy system with real-time market connections.
• If you have worked in energy, industrial, or IoT environments, state that directly because this role spans software and physical energy assets.

What to cover in your cover letter

['Your experience as a security owner or head of security and the size and scope of teams you have led.', 'How you would lead Team Trust inside a Core Platforms domain and work with the wider 1KOMMA5° group.', 'Concrete examples of securing systems that combine cloud software with physical or real-time components.', 'Why the 1KOMMA5° goal of CO2-neutral buildings and a virtual power plant connected to the electricity market matters to you.']

Research before applying

• Study how 1KOMMA5° describes the virtual power plant and Heartbeat AI, and how the electricity market connection works.
• Look up Heartbeat AI GmbH and its relationship to the 1KOMMA5° group, since this role is the security owner for that entity.
• Review 1KOMMA5°'s product and tech team pages and any public material on their Core Platforms domain.
• Check the company's locations and scale, from Finland to Australia, to understand the geographic spread you would support.

Likely interview topics

Based on the job description, expect questions about:

• How would you organise security ownership for Heartbeat AI across the 1KOMMA5° group?
• What changes when you secure a virtual power plant that controls solar, batteries, heat pumps, and e-mobility in real time?
• How do you lead a security team inside a Core Platforms domain and prioritise work with product and engineering teams?
• Describe a time you acted as the security owner for a technology organisation and handled a major security decision.
• How would you approach security for a system directly connected to the electricity market and fully automated?

Common mistakes to avoid

• Treating this as a standard data-centre security role and ignoring the energy system, hardware, and real-time market components.
• Applying without showing any understanding of 1KOMMA5°'s virtual power plant or Heartbeat AI.
• Focusing only on tools and certifications instead of giving examples of leading a security team and owning security across an organisation.