Security, Compliance and Group IT Administrator
A
hands-on security, compliance and IT operations role. You'll run information
security and compliance day to day for Power Tech Nexus, take us through
ISO/IEC 42001 certification, and look after the Microsoft 365 and multi-cloud
environments the group runs on, including what they cost.
At
a Glance
• Location: India (preferred, Hybrid); other
locations considered
• Employment type: Full-time, permanent
• Experience: 3–5 years in information
security, GRC, or IT and cloud administration, including hands-on ISO/IEC
27001:2022 work
• Role type: Hands-on across policy, technical
verification, and day-to-day administration, not a people-management role
• Core focus: ISO/IEC 27001 and 42001, control
evidence, Entra ID and Microsoft 365 administration, Azure, AWS and GCP
administration, and FinOps
• Reports to: CISO
• Working hours: Shifted India hours with at
least 4 hours' daily overlap with Australian (Melbourne and Brisbane) business
hours, typically around 7:30am–4:30pm IST, adjusted for Australian daylight
saving
About
Power Tech Consulting
Power Tech is a data, AI, cloud, and
transformation consultancy serving mining, financial services, hospitality, and
government clients across Australia, New Zealand, Fiji, Singapore, and India.
We're multi-vendor, so we recommend what's right, not what's easy to sell, and
we're building our own products alongside client work.
Service through contribution. Trust
through transparency. Accountable from end to end. Join us and help shape what
Power Tech becomes.
About
the Role
Power Tech Nexus is the product
company of the Power Tech group. We build and run our own AI-driven software
products for businesses in Australia and the region. We are a small team
growing deliberately, so every hire shapes how the product and the engineering
practice turn out.
As Security, Compliance and Group IT
Administrator, you'll run our ISO/IEC 27001:2022-certified information security
management system (ISMS), lead our ISO/IEC 42001 AI management system (AIMS)
implementation through to certification, and keep our controls real and
evidenced. You'll also be the group's IT administrator: the person who looks
after our Microsoft 365 and Entra ID tenant, supports our people, administers
our Azure, AWS and GCP environments, and works with Finance on cloud spend. The
role suits someone equally comfortable writing a policy and reading a cloud
configuration to check the policy is actually applied.
Key
Responsibilities
• Own the ISMS, including the risk register,
Statement of Applicability, policies, and internal audit.
• Lead our ISO/IEC 42001 AIMS implementation
through to certification, including the AI impact assessment.
• Manage compliance evidence and control
testing in our compliance platform (Scrut), so controls are evidenced
continuously, not only before an audit.
• Run access reviews across cloud, source
control, and business systems.
• Embed secure development in how the team
builds product, including threat modelling, dependency and secret scanning, and
security review before release.
• Lead incident response and post-incident
reviews.
• Assess supplier and third-party security, and
answer customer security questionnaires.
• Deliver security awareness for the team.
• Provide Group IT administration and support:
onboarding and offboarding, devices, licences, and first-line and escalated
support for staff across Australia and India, with requests tracked and
resolved within agreed times.
• Administer our Microsoft Entra ID tenant,
including users, groups, Conditional Access, Privileged Identity Management,
MFA, and app registrations, keeping it aligned to the identity model our lead
architect designs.
• Administer Exchange Online and SharePoint
Online, including mailboxes, mail flow, retention and sharing policies, site
and permission structures, and Microsoft 365 licensing.
• Administer our Azure, AWS, and GCP
environments at the tenant, subscription, account, and project level: landing
zones, role assignments, guardrails and policy, and security findings from
Defender for Cloud and the AWS and GCP equivalents. Product workloads and their
infrastructure as code remain with the DevOps / Platform Engineer.
• Run FinOps with the Finance team: tag and
allocate cloud costs by product and entity, track spend against budget, report
monthly, flag anomalies early, and recommend savings such as rightsizing,
reservations, and shutting down unused resources.
• Keep runbooks, decisions, and handovers
written down, and make administrative changes through reviewed code or a
recorded change wherever possible, not ad hoc in a portal.
Must-Have
Skills and Experience
• 3–5 years in information security, GRC, or IT
and cloud administration, including hands-on work on an ISO/IEC 27001:2022 ISMS
through at least one certification or surveillance audit, covering risk
assessment, the Statement of Applicability, policy writing, and internal audit.
• Can read, verify, and administer Azure and
Entra ID configuration (Conditional Access, Privileged Identity Management,
RBAC, Defender for Cloud findings), with working knowledge of AWS IAM, and
confirm a control is actually applied.
• Hands-on Microsoft 365 administration,
including Exchange Online and SharePoint Online, and running IT support for a
small distributed team.
• Working administration experience of AWS and
GCP (accounts or projects, IAM, organisation policy, billing), at the level
needed to govern and support them.
• GitHub security controls (branch protection,
required reviews, secret scanning, and dependency scanning) and experience
embedding secure development, including threat modelling, security review
before release, and reviewing infrastructure-as-code pull requests for security
impact.
• Experience managing controls and evidence in
a GRC or compliance-automation platform (we use Scrut).
• Experience leading or taking a key role in
security incident response.
• Practical cloud cost management: reading cost
and billing data across providers and explaining it to a finance team.
• Clear writing, shown in policies and
questionnaire answers that people can follow and auditors can verify.
Desirable
Skills
• ISO/IEC 42001 (AI management system, AI
impact assessment); our implementation is in progress.
• AI security: OWASP Top 10 for LLM
applications, prompt injection, and data leakage.
• ISO 27001 Lead Implementer or Lead Auditor,
CISSP, CISM, a cloud security certification, or Microsoft 365 Administrator
Expert, or a FinOps Certified Practitioner credential.
• Privacy and security frameworks in our
markets: India's DPDP Act, Australia's Privacy Act, and the Essential Eight.
• Scripting in Python, PowerShell, or KQL,
including Microsoft Graph and cloud CLI automation.
• Experience in a product company or start-up
where security sits close to engineering.
Education
A bachelor's degree in computer
science, information security, information technology, or a related field, or
equivalent experience.
What
Success Looks Like
• Our ISO/IEC 27001 and 42001 audits go
smoothly, because controls are evidenced throughout the year, not assembled at
the last minute.
• Security checks are a normal part of every
release, and access across cloud, source control, and business systems matches
people's roles, with reviews completed on schedule.
• Our people have what they need on day one,
requests are resolved quickly, and the Microsoft 365, Azure, AWS, and GCP
environments are tidy, secure, and well documented.
• Finance can see cloud spend by product and
entity, there are no surprise bills, and savings are identified and acted on.
