Security, Compliance and Group IT Administrator

Power Tech Nexus · Product Engineering

A hands-on security and compliance role. You'll run information security and compliance day to day for Power Tech Nexus, reporting to our CISO. You'll run our ISO/IEC 27001:2022-certified information security management system (ISMS) and lead our ISO/IEC 42001 AI management system (AIMS) implementation through to certification, keep our controls real and evidenced, and make security part of how the team builds and ships product.

The role suits someone equally comfortable writing a policy and reading a cloud configuration to check the policy is actually applied.

At a Glance

• Location: India (preferred), hybrid; other locations considered
• Employment type: Full-time, permanent
• Openings: 1
• Reports to: CISO
• Role type: Hands-on across policy and technical verification; not a people-management role
• Hiring entity: Power Tech Nexus Private Limited
• Working hours: Shifted India hours with at least 4 hours' daily overlap with Australian (Melbourne/Brisbane) business hours, typically around 7:30am–4:30pm IST, adjusted for Australian daylight saving.

About Power Tech Nexus

Power Tech Nexus is the product company of the Power Tech group. We build and run our own AI-driven software products for businesses in Australia and the region. We are a small team growing deliberately, so every hire shapes how the product and the engineering practice turn out.

What you will do

• Own the ISMS, including the risk register, Statement of Applicability, policies and internal audit
• Manage compliance evidence and control testing in Scrut, so controls are evidenced continuously, not only before an audit
• Run access reviews across cloud, source control and business systems
• Embed secure development in how the team builds product, including threat modelling, dependency and secret scanning, and security review before release
• Lead incident response and post-incident reviews
• Assess supplier and third-party security, and answer customer security questionnaires
• Deliver security awareness for the team

Technical Requirements

Must-have

• Hands-on work on an ISO/IEC 27001:2022 ISMS through at least one certification or surveillance audit, including risk assessment, the Statement of Applicability, policy writing and internal audit
• Can read and verify Azure and Entra ID configuration (Conditional Access, Privileged Identity Management, RBAC, Defender for Cloud findings), with working knowledge of AWS IAM, and confirm a control is actually applied
• GitHub security controls: branch protection, required reviews, secret and dependency scanning in CI, and reviewing infrastructure-as-code pull requests for security impact
• Embedding secure development: threat modelling and security review before release
• Managing controls and evidence in a GRC or compliance-automation platform (we use Scrut)
• Leading or taking a key role in security incident response
• Clear writing, shown in policies and questionnaire answers that people can follow and auditors can verify

Desirable

• ISO/IEC 42001 or AI governance (AI management system, AI impact assessment); our implementation is in progress
• AI security: OWASP Top 10 for LLM applications, prompt injection and data leakage
• ISO 27001 Lead Implementer or Lead Auditor, CISSP, CISM, or a cloud security certification
• Privacy and security frameworks in our markets: India's DPDP Act, Australia's Privacy Act and the Essential Eight
• Scripting in Python, PowerShell or KQL
• Experience in a product company or start-up where security sits close to engineering

Who you will work with

• CISO: sets security policy and is accountable for the ISMS
• DevOps / Platform Engineer: implements controls through infrastructure as code; you assure and evidence them
• Lead architect: designs the identity and platform model you review

How we work

• Small, senior team with a short path from idea to production
• AI-assisted engineering is part of the daily workflow, not an experiment
• Azure-first, with AWS where a product needs it. All infrastructure is code (Bicep or Terraform), changed through reviewed pull requests in GitHub, never by hand in the portal
• Security is built in from the start: we are ISO/IEC 27001:2022 certified and are implementing ISO/IEC 42001 for AI management
• Done means deployed and verified running, not merged
• We write things down: runbooks, decisions and handovers

How to apply

Apply with your CV and a short note on something you built or ran that you are proud of, and what you would do differently next time. We read every application and reply to everyone.

Applicants must have the right to work in their country of residence (India preferred).

Power Tech Nexus is an equal opportunity employer. We welcome applicants regardless of gender, age, religion, caste, ethnicity, disability, sexual orientation, marital status or background, and we will make reasonable adjustments during the hiring process. Tell us what you need.