The posting
IT Security & Infrastructure Engineer
Location: Mumbai | Employment Type: Full-time, on-site | Travel: Occasional, for new site deployments
Role Overview
We are seeking a hands-on IT Security & Infrastructure Engineer to manage and secure our day-to-day IT environment, while growing alongside us as we mature our security and compliance program. The organization is actively pursuing ISO 27001:2022 and SOC 2 certification, operates across Azure and AWS, and runs a synchronized multi-firewall setup.
This is a genuine growth role. The successful candidate will begin with hands-on responsibilities across endpoints, firewalls, network infrastructure, and end-user support — and progressively take on broader cloud networking, multi-firewall management, and compliance support. We are looking for someone with practical early-career experience who aspires to grow into a Security Engineer or Cloud Security role, rather than remain in pure operations.
The role is intentionally varied: a single day may involve resolving an end-user issue, configuring a site-to-site VPN tunnel to an Azure VNet, and travelling to a new office to set up server and network infrastructure. Breadth and adaptability are core to the position.
Our Environment
Technology Stack
AreaTools and Platforms
Security
Next-gen firewall, XDR, and VPN platforms (e.g. Sophos, Fortinet, Palo Alto)
Endpoint Management
Unified endpoint management tools (e.g. ManageEngine, Intune, SCCM)
Mobile Device Management
MDM platforms for iOS and Android patching, policy enforcement, and remote control
Network
Managed L2 switches and enterprise APs (e.g. TP-Link, EnGenius, Ubiquiti)
Endpoints
Windows, macOS, iOS, and Android
Access Control
Biometric devices (e.g. ESSL, Matrix, or equivalent)
Identity
Microsoft Active Directory
Cloud
Azure and AWS virtual networks, linked to on-premise infrastructure
Current Operating Posture
- Multi-firewall synchronized configuration (HA and multi-site)
- Azure and AWS virtual networks linked to on-premise firewall via IPSec site-to-site VPN
- ISO 27001:2022 ISMS implementation underway
- SOC 2 readiness and audit support in progress
- Periodic new office and server room rollouts as the business expands
Key Responsibilities
End-User Support
- Troubleshoot day-to-day Windows and macOS issues, including boot problems, profile corruption, application crashes, performance issues, and update or driver glitches
- Resolve common end-user concerns across Office productivity tools, Wi-Fi, printer setup, VPN access, password resets, and OneDrive/SharePoint
- Provide basic support for the iOS and Android mobile fleet
- Handle hardware-level tasks such as RAM/SSD upgrades, peripheral setup, and docking stations
- Maintain a disciplined ticketing rhythm — log, prioritize, resolve, and document
Endpoint and Asset Management
- Manage the endpoint fleet through a unified endpoint management platform for patch management, software deployment, asset tracking, and remote troubleshooting
- Execute Windows and macOS patch cycles end-to-end
- Enroll new machines into the Active Directory domain and apply baseline GPOs and security policies
- Manage user onboarding and offboarding cleanly
Mobile Device Management
- Administer the MDM platform for iOS and Android devices — enrollment, policy enforcement, and remote control
- Run mobile OS patch management through the MDM platform — schedule, deploy, and verify OS and app updates across the mobile fleet
- Enforce baseline mobile security policies — passcode requirements, encryption, app restrictions, and remote wipe readiness
- Track mobile device compliance and remediate non-compliant devices
Security Stack Administration
- Perform day-to-day firewall administration — rules, NAT, web filtering, traffic shaping, and log review
- Configure and monitor VPN services — site-to-site tunnels and remote-access connectivity
- Use the XDR / endpoint security console to triage alerts, investigate incidents, and document findings
- Help maintain the synchronized multi-firewall configuration, ensuring rules and policies remain in sync across devices
Cloud Networking (Azure and AWS)
- Configure and manage Azure Virtual Networks and AWS VPCs at a moderate level — subnets, route tables, NSGs / security groups
- Build and maintain IPSec site-to-site tunnels between cloud VNets/VPCs and the on-premise firewall
- Support hybrid connectivity, basic cloud identity, and resource access controls
Network Infrastructure
- Configure managed switches — VLANs, port settings, and basic Layer 2 operations
- Deploy and manage enterprise access points, including SSID configuration, wireless security, and coverage troubleshooting
- Diagnose and resolve end-to-end LAN/WAN connectivity issues
Server Setup and New Site Rollouts
Cross-functional collaboration with the Operations team
- Plan and execute the IT scope for new locations — cabling layout, switch and AP placement, firewall provisioning, and Wi-Fi coverage planning
- Rack, stack, and configure new server hardware; install operating systems, baseline configurations, and security tooling
- Establish domain connectivity, VPN links to HQ, endpoint enrollment, and biometric access at new sites
- Coordinate with ISPs, electricians, AMC partners, and equipment vendors throughout the rollout
- Prepare site readiness checklists, IT bills of quantity, and post-deployment documentation
- Be available for on-site work, including occasional evenings or weekends during cutover windows
Compliance and Governance (ISO 27001:2022 and SOC 2)
- Help implement and maintain technical controls aligned with ISO 27001:2022 Annex A and SOC 2 Trust Services Criteria
- Collect and maintain audit evidence — configurations, logs, change records, and access reviews
- Support internal audits, gap assessments, and external auditor engagements
- Maintain policies, runbooks, SOPs, asset registers, and risk treatment documentation
- Conduct periodic access reviews and firewall rule audits
Physical Access and General Operations
- Manage biometric access control devices — enrollment, data sync, and basic troubleshooting
- Coordinate with vendors and OEM support partners for escalations
- Contribute to security awareness initiatives across the organization
Candidate Profile
Must Have
- Practical hands-on IT, infrastructure, or security operations experience
- Confident troubleshooting on both Windows and macOS at the end-user level
- Working experience with a unified endpoint management platform (such as ManageEngine Endpoint Central, Intune, or SCCM) for patch management, software deployment, and asset tracking
- Working experience with an MDM platform for iOS and Android, including mobile OS patch management, policy enforcement, and device compliance tracking
- Hands-on with Active Directory — domain join, GPO basics, and user/computer object management
- Practical exposure to firewall administration — rule configuration, NAT, and VPN setup (experience with any major vendor acceptable; Sophos, Fortinet, Cisco, or Meraki)
- Strong networking fundamentals — TCP/IP, DNS, DHCP, VLANs, NAT, routing, and wireless concepts
- Comfortable with physical and hardware work — racking, basic cabling, and on-site deployments
- Bachelor's degree in Computer Science, Information Technology, Electronics, or a related discipline; or a diploma supported by equivalent practical experience
Strong Plus
- Direct experience with an integrated security ecosystem (firewall + XDR + VPN from a single vendor)
- Cloud networking exposure — Azure VNets or AWS VPCs, NSGs / security groups, site-to-site VPN
- Exposure to ISO 27001 or SOC 2 environments, even at a supporting or evidence-collection level
- Prior site-rollout or office-setup experience, including IT scoping, cabling layout, and BoQ preparation
- Vendor-specific firewall or endpoint certifications
- Familiarity with biometric attendance and access control systems
Nice to Have
- CCNA, AZ-104, AZ-500, AWS Certified Cloud Practitioner, or comparable certifications
- Basic scripting (PowerShell, Python, or Bash) for routine automation
- Awareness of SIEM concepts
- ITIL awareness
Personal Attributes
- Practical and curious — prefers learning by doing
- Comfortable as a generalist — willing to specialize over time
- Patient with users — able to explain technical solutions clearly and respectfully
- Hands-on and grounded — willing to handle racking, cabling, and on-site work during rollouts
- Growth-oriented — interested in progressing into cloud security and compliance
- Clear communicator — produces documentation others can use
- Reliable and accountable — someone Operations can count on when a site goes live
Career Growth
Strong performers can progress into roles such as Senior Security Engineer, Cloud Security Engineer, or Information Security Analyst (ISO / SOC 2 lead) as the security function matures.
What This Role Is Not
- Not a pure network engineering role focused on BGP/OSPF or carrier-grade environments
- Not a SOC L1 monitoring-only role
- Not an application security or penetration testing role
- Not a senior or lead position — we are looking for someone hungry to grow, not someone already at the top of their career
- Not a pure helpdesk role — end-user support is one part of a broader scope
