Full job description

ABOUT NEXGEN INNOVATIONS

Nexgen Innovations Pty Ltd is a Melbourne-based technology company operating from Tullamarine, Victoria. The business has two arms: custom software development for Australian client organisations, and ongoing managed IT services for those same clients. Software delivery is supported by an engineering team in the company’s Sri Lanka office, while client relationships, cyber security, project delivery and infrastructure operations are run from Melbourne.

POSITION PURPOSE

The ICT Security Specialist holds end-to-end responsibility for information security at Nexgen Innovations. The role protects the company’s own systems, staff and offices; secures the cloud platforms on which client applications are built, deployed and hosted; and delivers security assessment and advisory work to clients supported under managed services agreements.

The position is the single point of accountability for identifying security risk across the business, putting practical controls in place, responding to security incidents affecting Nexgen or its clients, and ensuring client’s data and systems are handled securely in an environment of evolving security threats.

KEY DUTIES AND RESPONSIBILITIES

Security operations

• Administer and harden clients and the company’s Microsoft 365 and Entra ID tenancy, including conditional access policies, multi-factor authentication, privileged role assignment and device compliance for staff across the Melbourne and Sri Lanka offices.
• Manage vulnerability identification and patch remediation across staff devices, servers and cloud workloads, prioritising by risk and tracking findings through to closure.
• Monitor for, triage, contain and investigate security alerts and incidents affecting Nexgen or its managed services clients, and produce post-incident reports setting out root cause and corrective actions.

Cloud and application security

• Secure the Amazon Web Services, Supabase and Vercel environments used to build, deploy and host client applications, including IAM and role design, database and network access rules, secrets management, and enforced separation of development, staging and production environments.
• Review application code, third-party dependencies and CI/CD pipelines for security defects prior to client release, and work with the software engineering team to remediate issues before they reach production.
• Provide security input into the design of new client projects and internal systems, so that access control, data handling and logging are addressed at design time rather than retrofitted.

Governance, risk and compliance

• Develop, maintain and advise the company and clients on information security policies, standards and risk register, using ISO/IEC 27001 and the ACSC Essential Eight as reference frameworks to guide control selection and maturity improvement.
• Administer identity and access management for managed services clients, staff and contractors, including onboarding and offboarding, least-privilege review, and periodic recertification of access to Nexgen and client environments.
• Maintain and periodically test incident response, backup and business continuity procedures.

Client and advisory work

• Conduct security assessments and audits for managed services clients, document findings and remediation plans, and present outcomes to client stakeholders.
• Complete client security questionnaires, due diligence requests and contractual security schedules as part of the company’s tender, bid and client onboarding processes.
• Deliver security awareness training to Nexgen staff and contractors, and maintain practical security guidance for the engineering teams.

KEY SELECTION CRITERIA — ESSENTIAL

• A Bachelor degree in Information Technology, Computer Science, Cybersecurity or a closely related discipline.
• At least three years’ experience in an information security, cyber security or ICT security audit role.
• Hands-on experience administering security controls in both Amazon Web Services and a Microsoft 365 / Entra ID environment.
• Practical knowledge of application and platform security, including access control, secrets management, and separation of development, staging and production environments.
• Working knowledge of ISO/IEC 27001 and the ACSC Essential Eight, and the ability to apply them as practical improvement frameworks rather than as a certification exercise.
• Demonstrated ability to document security findings clearly and explain them to non-technical client stakeholders.
• Sound analytical and problem-solving skills, with the judgement to prioritise competing risks in a small-team environment where the role operates with a high degree of autonomy.

KEY SELECTION CRITERIA — DESIRABLE

• An industry certification such as CISSP, CISM, CompTIA Security+, AWS Certified Security or Microsoft SC-200.
• Experience with Supabase, Vercel or comparable managed application and hosting platforms.
• Experience preparing an organisation for, or auditing against, ISO/IEC 27001.
• Experience with secure code review, static analysis or dependency scanning tooling.
• Prior experience in a software development house or managed services provider, where security responsibilities span both internal systems and client environments.

KEY RELATIONSHIPS

• Melbourne software engineering and frontend development teams: secure development practices and remediation of identified defects.
• Sri Lanka engineering team: secure access to development environments and client data, and consistent application of security standards across both offices.
• IT Infrastructure and DevOps consultant: joint responsibility for hardening of infrastructure and deployment pipelines.
• Company directors: reporting on security posture, risk and incidents.
• Clients: primary contact for security matters arising under managed services agreements.
• External vendors and service providers: security tooling, assessments and penetration testing where engaged.

NATURE OF THE POSITION

This is a full-time, ongoing position. The duties described above are a continuing requirement of the business and are not project-based or fixed-term.

Pay: From $80,000.00 per year

• Work Location: Hybrid remote in Tullamarine VIC