Apply for Security, Compliance and Group IT Administrator.

Security, Compliance and Group IT Administrator

A hands-on security, compliance and IT operations role. You'll run information security and compliance day to day for Power Tech Nexus, take us through ISO/IEC 42001 certification, and look after the Microsoft 365 and multi-cloud environments the group runs on, including what they cost.

At a Glance

• Location: India (preferred, Hybrid); other locations considered

• Employment type: Full-time, permanent

• Experience: 3–5 years in information security, GRC, or IT and cloud administration, including hands-on ISO/IEC 27001:2022 work

• Role type: Hands-on across policy, technical verification, and day-to-day administration, not a people-management role

• Core focus: ISO/IEC 27001 and 42001, control evidence, Entra ID and Microsoft 365 administration, Azure, AWS and GCP administration, and FinOps

• Reports to: CISO

• Working hours: Shifted India hours with at least 4 hours' daily overlap with Australian (Melbourne and Brisbane) business hours, typically around 7:30am–4:30pm IST, adjusted for Australian daylight saving

About Power Tech Consulting

Power Tech is a data, AI, cloud, and transformation consultancy serving mining, financial services, hospitality, and government clients across Australia, New Zealand, Fiji, Singapore, and India. We're multi-vendor, so we recommend what's right, not what's easy to sell, and we're building our own products alongside client work.

Service through contribution. Trust through transparency. Accountable from end to end. Join us and help shape what Power Tech becomes.

About the Role

Power Tech Nexus is the product company of the Power Tech group. We build and run our own AI-driven software products for businesses in Australia and the region. We are a small team growing deliberately, so every hire shapes how the product and the engineering practice turn out.

As Security, Compliance and Group IT Administrator, you'll run our ISO/IEC 27001:2022-certified information security management system (ISMS), lead our ISO/IEC 42001 AI management system (AIMS) implementation through to certification, and keep our controls real and evidenced. You'll also be the group's IT administrator: the person who looks after our Microsoft 365 and Entra ID tenant, supports our people, administers our Azure, AWS and GCP environments, and works with Finance on cloud spend. The role suits someone equally comfortable writing a policy and reading a cloud configuration to check the policy is actually applied.

Key Responsibilities

• Own the ISMS, including the risk register, Statement of Applicability, policies, and internal audit.

• Lead our ISO/IEC 42001 AIMS implementation through to certification, including the AI impact assessment.

• Manage compliance evidence and control testing in our compliance platform (Scrut), so controls are evidenced continuously, not only before an audit.

• Run access reviews across cloud, source control, and business systems.

• Embed secure development in how the team builds product, including threat modelling, dependency and secret scanning, and security review before release.

• Lead incident response and post-incident reviews.

• Assess supplier and third-party security, and answer customer security questionnaires.

• Deliver security awareness for the team.

• Provide Group IT administration and support: onboarding and offboarding, devices, licences, and first-line and escalated support for staff across Australia and India, with requests tracked and resolved within agreed times.

• Administer our Microsoft Entra ID tenant, including users, groups, Conditional Access, Privileged Identity Management, MFA, and app registrations, keeping it aligned to the identity model our lead architect designs.

• Administer Exchange Online and SharePoint Online, including mailboxes, mail flow, retention and sharing policies, site and permission structures, and Microsoft 365 licensing.

• Administer our Azure, AWS, and GCP environments at the tenant, subscription, account, and project level: landing zones, role assignments, guardrails and policy, and security findings from Defender for Cloud and the AWS and GCP equivalents. Product workloads and their infrastructure as code remain with the DevOps / Platform Engineer.

• Run FinOps with the Finance team: tag and allocate cloud costs by product and entity, track spend against budget, report monthly, flag anomalies early, and recommend savings such as rightsizing, reservations, and shutting down unused resources.

• Keep runbooks, decisions, and handovers written down, and make administrative changes through reviewed code or a recorded change wherever possible, not ad hoc in a portal.

Must-Have Skills and Experience

• 3–5 years in information security, GRC, or IT and cloud administration, including hands-on work on an ISO/IEC 27001:2022 ISMS through at least one certification or surveillance audit, covering risk assessment, the Statement of Applicability, policy writing, and internal audit.

• Can read, verify, and administer Azure and Entra ID configuration (Conditional Access, Privileged Identity Management, RBAC, Defender for Cloud findings), with working knowledge of AWS IAM, and confirm a control is actually applied.

• Hands-on Microsoft 365 administration, including Exchange Online and SharePoint Online, and running IT support for a small distributed team.

• Working administration experience of AWS and GCP (accounts or projects, IAM, organisation policy, billing), at the level needed to govern and support them.

• GitHub security controls (branch protection, required reviews, secret scanning, and dependency scanning) and experience embedding secure development, including threat modelling, security review before release, and reviewing infrastructure-as-code pull requests for security impact.

• Experience managing controls and evidence in a GRC or compliance-automation platform (we use Scrut).

• Experience leading or taking a key role in security incident response.

• Practical cloud cost management: reading cost and billing data across providers and explaining it to a finance team.

• Clear writing, shown in policies and questionnaire answers that people can follow and auditors can verify.

Desirable Skills

• ISO/IEC 42001 (AI management system, AI impact assessment); our implementation is in progress.

• AI security: OWASP Top 10 for LLM applications, prompt injection, and data leakage.

• ISO 27001 Lead Implementer or Lead Auditor, CISSP, CISM, a cloud security certification, or Microsoft 365 Administrator Expert, or a FinOps Certified Practitioner credential.

• Privacy and security frameworks in our markets: India's DPDP Act, Australia's Privacy Act, and the Essential Eight.

• Scripting in Python, PowerShell, or KQL, including Microsoft Graph and cloud CLI automation.

• Experience in a product company or start-up where security sits close to engineering.

Education

A bachelor's degree in computer science, information security, information technology, or a related field, or equivalent experience.

What Success Looks Like

• Our ISO/IEC 27001 and 42001 audits go smoothly, because controls are evidenced throughout the year, not assembled at the last minute.

• Security checks are a normal part of every release, and access across cloud, source control, and business systems matches people's roles, with reviews completed on schedule.

• Our people have what they need on day one, requests are resolved quickly, and the Microsoft 365, Azure, AWS, and GCP environments are tidy, secure, and well documented.

• Finance can see cloud spend by product and entity, there are no surprise bills, and savings are identified and acted on.