Onboarding an employee in Employment Hero and onboarding them in a security awareness programme are usually two unrelated jobs, done by two different people, days apart. The gap between them is the exposure: a new starter's mailbox goes live, credential-heavy onboarding emails pour in, and the first security lesson is still unscheduled. This workflow closes the gap - when Employment Hero creates an employee, Cyber Aware creates the learner.
TL;DR
- Employment Hero's Zapier integration fires when an employee is created in the payroll platform.
- Cyber Aware accepts the learner through its API or webhooks and enrols them in the default training schedule.
- The triggers are instant - no polling delay like most Zapier connections.
- A second flow on employee removal keeps leavers out of your reporting.
- Total setup is under an hour: one trigger, one action, one test.
Why this matters
The first week of employment is the highest-risk week of the employment. Mailboxes are fresh, suspicious-onboarding emails arrive by the dozen, and the new hire has no baseline for what "normal" looks like. Security teams know this; the problem is sequencing. Payroll paperwork happens first, mailbox provisioning second, training third or never.
Automating the handoff changes the sequence. The moment an employee record exists in Employment Hero, the learner exists in Cyber Aware - with a welcome email, a default training schedule and branded certificates waiting. Nobody has to remember to ask, and nobody has to chase an MSP ticket.
There is also a leaver side. When someone exits in Employment Hero, a parallel flow removes them from Cyber Aware, so departed staff stop appearing as active learners. Without it, your human risk reporting quietly counts people who no longer exist - the kind of detail an auditor loves to find.
Who this is for
Australian MSPs whose clients run Employment Hero for HR and payroll, and internal IT or people-ops teams at businesses hiring on it. If you already use Zapier for other onboarding steps, this is one more Zap; if not, it is a good first one.
Before you start
- An Employment Hero account with access to the payroll platform. Employment Hero's Zapier integration launched globally in July 2024 and connects to the payroll platform's events.
- A Zapier account. Employment Hero connects through Zapier with triggers including employee created, pay run initialised and pay run finalised.
- A Cyber Aware partner account with API or webhooks access available on the plan.
- A test employee you can create and remove without touching payroll - build it in a sandbox or inactive state if your plan allows.
- The gotcha: the integration is to Employment Hero's payroll platform. Employee records created only in the HR module may not fire the same trigger, so confirm where your client actually creates staff records before you wire the flow.
Step 1 - Set the Employment Hero trigger
- In Zapier, create a new Zap and pick Employment Hero (listed as Employment Hero Payroll Software) as the trigger app.
- Choose the trigger for employee created in the payroll platform.
- Connect your Employment Hero account and authorise the connection.
- Run the test step and pull one sample employee.
Employment Hero documents the available automation events in its Zapier integration announcement: employee created in the payroll platform, pay run initialised and pay run finalised. Unlike most polling-based Zapier apps, these triggers fire instantly - the event starts the Zap the moment it happens.
Expected result: the test step returns a real employee with first name, last name and work email populated. If a field is blank, complete it on the employee record and retest - an empty work email will break the next step.
Step 2 - Create the learner in Cyber Aware
- Add an action step: Cyber Aware, using the API or webhooks integration.
- Map first name, last name and work email from the Employment Hero trigger.
- Select the client portal and the default training schedule the learner should enter.
- Save, then test the action against the sample record.
Expected result: the learner appears in Cyber Aware's learner list immediately, the welcome email is sent, and baseline courses are assigned without any manual step. From here the platform takes over: monthly story-driven courses auto-add to every learner's queue, due and overdue reminders fire on schedule, and completion issues a branded certificate under your brand, not Cyber Aware's.
Step 3 - Build the leaver flow
- Duplicate the Zap and change the trigger to the employee-removal event in Employment Hero.
- Point the action at Cyber Aware's remove or deactivate learner endpoint, matched on work email.
- Test with a throwaway record.
This second flow is what makes the workflow audit-proof rather than merely convenient. Enrolment without removal eventually produces a learner list full of ex-staff, and completion reports that include people who left the company do not survive an audit read.
Step 4 - Verify the whole chain
- Create a test employee in Employment Hero.
- Confirm the Zap fires instantly and the learner lands in Cyber Aware with a welcome email.
- Complete a course as the test learner and confirm the branded certificate issues.
- Remove the test employee and confirm the learner disappears from the active list.
Expected result: four events, zero manual actions. If any leg fails, the fix is almost always a missing field on the Employment Hero record or a mis-mapped email field between the two steps.
How the workflow fits an MSP's onboarding standard
Once one client runs this flow, template it. The Zap is per-client but the shape is identical: trigger on employee created, action into that client's Cyber Aware portal. Bundle the setup into your onboarding checklist next to mailbox provisioning, so every new client engagement ships with training enrolment already wired.
| Stage | Tool | Human action needed |
|---|---|---|
| Hire record | Employment Hero | HR enters the employee |
| Learner creation | Zapier flow | None |
| Training cadence | Cyber Aware | None - auto-add monthly |
| Phishing practice | Cyber Aware Auto Phish | None - scheduled yearly |
| Leaver removal | Zapier flow | None |
The only remaining human step is watching the results - which the reporting page turns into a monthly read, not a chase.
Troubleshooting
- The Zap does not fire on a new employee. The record was created in the HR module, not the payroll platform. Confirm where the client creates staff and switch the trigger accordingly.
- The Cyber Aware action errors on create. The work email field was empty or mis-mapped. Require work email on Employment Hero records and re-map the field.
- Two learner records for one person. A previous CSV import plus the new flow both created the learner. Remove the manual import and let the automated flow own the list.
- Certificates carry the wrong brand. The portal's branding settings were not confirmed before go-live. Set the client's logo and colours in the Cyber Aware portal settings before the first learner arrives.
What to do next
Enrolment is the first mile; the programme is security awareness training - monthly story-driven courses, quizzes and leaderboards that keep completion rates up after the novelty wears off. Layer phishing simulations on a steady cadence so the new starter's first suspicious email is a test, not a real attack.
FAQ
Does Employment Hero connect to Cyber Aware?
Yes - through Zapier. Employment Hero's Zapier integration fires when an employee is created in the payroll platform, and Cyber Aware creates the matching learner through its API or webhooks.
Do I need a developer to build this?
No. The flow is a two-step Zap: Employment Hero trigger, Cyber Aware action. Setup is under an hour including a test.
How fast does enrolment happen after hire?
Immediately. Employment Hero's Zapier triggers are instant events - the Zap fires as the employee is created, unlike polling-based connections that wait for the next check cycle.
What happens when an employee leaves?
A second Zap on the employee-removal event removes the learner from Cyber Aware, so ex-staff stop appearing in your reporting and completion history.
Do new hires get a welcome email automatically?
Yes. Learners created through Cyber Aware's Auto Enrol land in the default training schedule automatically, welcome email included.
Is the training branded for the client?
Yes - portals, notification emails and certificates carry the partner's brand rather than Cyber Aware's.
Does this work for clients on other HR systems?
The same shape works for any trigger that can reach Cyber Aware's API or webhooks - Google Workspace, Microsoft 365, CSV or a signup link all enrol learners into the default schedule.
One last thing
Audit the onboarding email traffic your clients send in week one. Offer letters, payroll set-up links and IT credential emails all train new starters that clicking links in unexpected mail is normal - the exact reflex phishing exploits.