IT & Security Operations Lead

Who We Are
ParamAIQ is an applied-AI company building NyaayOS, the reasoning layer for Indian law. We turn the primary sources of Indian law, from the BNS, BNSS and BSA to decades of Supreme Court and High Court precedent, into something any advocate can stand on. Work that took days takes minutes.
India has more than 55 million pending cases, and the outcome for a litigant can turn on who they can afford. We're building the foundation that gives an independent lawyer the same analytical leverage as a partner at a leading firm, and we build it with practising lawyers, not just for them.
Why This Role Matters
Today we run on Microsoft 365 and Slack with no central identity platform, no device management baseline, no formal service desk, and no security framework. There is no Active Directory. This is not a role that inherits a mature estate and governs it.
This is a build role first and a governance role second. In your first year you'll design and stand up the identity, endpoint, network and security foundations for the whole group, and then run them well. You'll have one engineer working to you from day one, real budget, and a direct line to the CTO. You'll also be hands-on: at our size, the person who designs conditional access is the same person who occasionally re-images a laptop.
What You'll Own
Identity & access: Microsoft Entra ID and Active Directory as the group's authoritative identity source. SSO, MFA, conditional access, RBAC, privileged access, joiner-mover-leaver, and periodic access reviews.
Microsoft 365: Tenant administration and governance, Exchange Online, SharePoint, OneDrive, licensing optimisation, multi-entity and multi-domain design, and security baselines.
Slack: End-to-end administration (Teams chat is deliberately disabled). SSO and SCIM from Entra ID, retention and eDiscovery, DLP, app approval, and guest governance.
Endpoint management: A mixed Windows and macOS fleet of roughly 100 devices. Intune, Apple Business Manager with zero-touch enrolment, FileVault escrow, and a macOS patching approach of your recommendation.
Security operations: SPF, DKIM and DMARC across all domains, endpoint protection, vulnerability posture, phishing simulation and awareness training, shadow-IT discovery, secrets hygiene, and an incident response runbook you've actually rehearsed.
Compliance & audit: IT controls evidence for SOC 2, IT's obligations under India's DPDP Act including breach notification readiness, the asset register, e-waste rules, and access control and CCTV administration.
Infrastructure & network: Firewall, VPN, Wi-Fi and ISPs, the new Mumbai office comms room and cabling handover, and the physical environment for on-premises GPU infrastructure (power, cooling, access, encryption at rest).
Backup, DR & continuity: Backup standards, defined recovery objectives, restores tested on a schedule, and documented continuity procedures.
Service management: Select and run our first ticketing system, publish SLAs, direct the Network & Helpdesk Engineer's work, and own major incident escalation.
Vendors & budget: Microsoft partners, ISPs, hardware and SaaS vendors. Contracts, renewals, endpoint procurement, vendor security reviews, and input into the annual IT budget.
What Success Looks Like in Year One
We'll judge this role on outcomes, not activity. By the end of your first twelve months we expect:
Identity is authoritative: Entra ID and Active Directory deployed, everyone provisioned from a single source, and SSO live for our top applications including Slack
MFA and conditional access at 100%: No exceptions without a documented, time-bound approval
Every device managed: 100% of Windows and macOS endpoints enrolled, encrypted, patch-compliant and in a single inventory
Joiner-mover-leaver is a process, not a favour: Documented, measured against an SLA, with offboarding that reliably revokes access on the day it should
A service desk exists: Ticketing live, SLAs published, and a baseline satisfaction measure
Recovery is proven, not assumed: At least one full documented restore test for each critical system
Audit-ready: SOC 2 IT evidence produced on a defined schedule, and DPDP obligations mapped to owners
The estate is documented: Asset register, network documentation, and runbooks your engineer can work from without you
Scope Boundary
You own corporate IT: identity, endpoints, the corporate network, SaaS, and the physical technology environment, including power, cooling, access control and encryption for our on-premises GPU hardware.
Engineering owns production cloud infrastructure, the build and deployment pipeline, and the product environment. You're consulted on those and own identity and access into them, but you're not the approver for production change.
Where the boundary is genuinely unclear, raise it rather than either annexing or ignoring it.
What You Bring
You've personally built a Microsoft identity platform from nothing, with Entra ID and Active Directory designed, deployed and cut over, not just administered one someone else built
Deep, hands-on Microsoft 365 tenant administration: Exchange Online, SharePoint, OneDrive, licensing, security baselines and conditional access
Real endpoint management across Windows and macOS, including Intune and Apple Business Manager, and opinions about managing Macs properly
You've carried SOC 2, ISO 27001 or an equivalent framework as the person who produced the IT evidence, not a bystander to the audit
Comfortable being hands-on and hands-off in the same day: architecture in the morning, a stuck user in the afternoon, without resenting either
You can lead one engineer well: allocate work, review it honestly, and grow them
Patience with non-technical users in a trading business and a biotech who don't think in tickets
Bonus Points
Slack administration at organisation scale: SCIM, retention, DLP, eDiscovery, app governance
Multi-entity or multi-company tenant design, including data segregation and per-entity licensing and cost allocation
Familiarity with India's DPDP Act as it applies to IT operations
Commissioning a new office: comms room, structured cabling, access control and CCTV integration
Exposure to on-premises GPU or high-density compute environments
Working fluency in Hindi or Marathi alongside English
What You Get
A true build opportunity: design the group's identity, endpoint, network and security foundations from scratch
One engineer working to you from day one, and real budget
A direct line to the CTO
Group-wide scope across trading, biotech and legal tech, including the infrastructure behind India's agentic legal AI

Work arrangement
No