Security & Compliance Officer

Power Tech Nexus · Product Engineering

We are looking for a Security & Compliance Officer to own information security for Power Tech Nexus. You will run our ISO 27001 information security management system, keep our controls real and evidenced, and make security part of how the team builds and ships product.

This role suits someone equally comfortable writing a policy and reading a cloud configuration to check the policy is actually applied.

About Power Tech Nexus

Power Tech Nexus is the product company of the Power Tech group. We build and run our own AI-driven software products, including Power EA, for Australian businesses. We are a small team growing deliberately, so every hire shapes how the product and the engineering practice turn out.

What you will do

• Own the ISMS: risk register, Statement of Applicability, policies and internal audit
• Manage compliance evidence and control testing in our compliance platform
• Run access reviews across cloud, source control and business systems
• Embed secure development: threat modelling, dependency and secret scanning, security review before release
• Lead incident response and post-incident reviews
• Assess supplier and third-party security, and answer customer security questionnaires
• Deliver security awareness for the team

What you will bring

• Four or more years in information security, with hands-on ISO 27001 implementation or audit experience
• Working knowledge of Azure and AWS security controls and identity (Entra ID, IAM)
• Risk assessment and treatment planning
• Incident response experience
• Clear written communication: policies, reports and questionnaire answers
• Familiarity with the Essential Eight and the Australian Privacy Principles

Nice to have

• ISO 27001 Lead Implementer or Lead Auditor, CISSP, CISM or similar
• Experience with a compliance automation platform (Scrut, Vanta, Drata)
• SOC 2
• Security for AI systems (prompt injection, data leakage, model access control)
• Scripting in Python or PowerShell

How we work

• Small, senior team with a short path from idea to production
• AI-assisted engineering is part of the daily workflow, not an experiment
• Security and ISO 27001 controls are built in from the start, not bolted on
• Done means deployed and verified running, not merged
• We write things down: runbooks, decisions and handovers

How to apply

Apply with your CV and a short note on something you built or ran that you are proud of, and what you would do differently next time. We read every application and reply to everyone.

Applicants must have the right to work in Australia.