IT Manager | Cyber Security & Microsoft Cloud Security
Arpit Dahal
I run IT and cyber security at Alliance SI, a national network infrastructure company whose clients include hyperscale and colocation data centres. My work sits where security engineering meets compliance: Entra ID, Intune and Defender on one side; ISO 27001, the Essential Eight and DISP on the other.
Cloud-only Microsoft estate with an MSP I govern
First certification and annual surveillance audit, both passed
ML1 self-assessed · ML2 uplift underway
Software inventory resolved for application allowlisting
Selected Projects
Selected Projects
Application control on a field-heavy fleet
Context
Most of our users are field technicians who can't stop a job because an app is blocked, and application control is one of the Essential Eight mitigation strategies.
What I did
I put interim enforcement in place with an AppLocker policy deployed through Intune: audit mode first, with an exception register throughout. For the move to Airlock Digital allowlisting on our path to Essential Eight ML2, I owned the allowlist review. Every application in our software inventory got a decision (approve, remove or named-user exception), cross-checked against Defender vulnerability management data with KQL. High-risk tools went to named-user exceptions instead of blanket approval.
Result
Every application in the inventory resolved: approved, marked for removal, scoped to named users or held for review. The review also surfaced a KQL trap I've written up.
ISO 27001 certification and surveillance audit
Context
Working with hyperscale and colocation data-centre clients, and in Defence, requires ISO 27001 certification and meeting DISP obligations.
What I did
Implemented the Microsoft controls behind our Statement of Applicability: Conditional Access hardening (including blocking legacy authentication and device code flow), MFA registration and separate admin accounts, Defender for Endpoint, Microsoft Sentinel and privileged access management. Collected the audit evidence and worked through the ISO 27001 and DISP control items.
Result
Alliance SI achieved its first ISO 27001 certification after I joined, then passed its annual surveillance audit. My part was the technical controls.
Bringing on an MSP without losing control
Context
Alliance SI moved day-to-day IT operations to a managed services provider in August 2026, while accountability for security and compliance stayed in-house.
What I did
Led the technical onboarding: scoped access for the MSP's engineers, the RACI matrix, the Essential Eight ML1 sprint plan, and the handover of our offboarding checklist. I now govern the relationship as IT Manager (escalations, changes and compliance alignment) and I'm coordinating the telephony migration to Teams. After a security change exposed an undocumented mail-flow dependency, I'm updating our Microsoft 365 change-impact assessment so business-system dependencies are reviewed before any security or mail-flow change.
Result
Live since August 2026 with a defined RACI and escalation path.
Cyber risk, audit and incident readiness
Context
Alongside the technical work, I carry the ongoing risk and assurance work for the business.
What I did
- Prepared and ran a cyber tabletop exercise using an Exercise in a Box scenario, then wrote the formal report and action plan.
- Completed our cyber insurance renewal.
- Assessed subcontractors' information security with our supplier security questionnaire.
- Handled the IT side of the FY26 financial audit: access reviews across finance and operations systems, and log investigations in Microsoft Sentinel.
Result
Incident response tested in practice, with an action plan; cyber insurance renewed; audit requests closed.
Writing
A zero in advanced hunting is a claim, not a fact
What an application allowlist review taught me about searching Defender's software inventory with KQL, and why every "not installed" result needs a second query.
Read the write-up →More work
- Built a Power Apps and Power Automate visitor management system with a full audit trail for Defence-contract sites.
- Delivered a new office network end to end: ISP, Meraki firewall, VLAN segmentation and Wi-Fi.
- Built a client-side PDF tools page for staff (files never leave the device), rolled out through Intune managed bookmarks.
- Package and deploy Win32 apps through Intune with PSAppDeployToolkit and custom detection scripts.
Side project
Day Trading Journal: a trading journal app I built and run on Android and the web. 1,300+ signups with organic growth, AI screenshot import (n8n + Claude Vision), TradingView charts and a Firebase backend.
Technical Capabilities
Tools and frameworks I work with.
Security operations & engineering
- Microsoft Defender for Endpoint & Defender Vulnerability Management
- Microsoft Sentinel & KQL (advanced hunting)
- Application control: Airlock Digital, App Control for Business (WDAC), AppLocker
- Incident response & tabletop exercises
Identity & Microsoft cloud
- Entra ID: Conditional Access, MFA, privileged access, app consent governance
- Intune: compliance policies, Autopilot, Win32 app packaging
- Microsoft 365: Exchange Online mail flow, SharePoint, Teams
- Microsoft Purview sensitivity labels
- Azure RBAC
Governance, risk & compliance
- ISO 27001 controls & audit evidence
- Essential Eight (ML1 → ML2)
- DISP
- Change-impact assessment
- MSP & vendor governance
- Supplier security assessments
Automation & development
- PowerShell & Microsoft Graph
- Power Automate & Power Apps
- n8n
- Next.js / TypeScript
- Cloudflare
Infrastructure & tooling
- Meraki firewalls & wireless, VLANs, DNS/DHCP/VPN
- Windows Server & Active Directory
- N-central RMM
- ServiceNow, Jira
About Me
I came up through the service desk at NRMA, joined Alliance SI as ICT Systems Administrator in 2025, and became IT Manager in 2026.
Most of our users work on job sites, not at desks, so security controls have to work for a technician with a label printer and a job to finish. That's why I prefer named, documented exceptions to blanket approvals. The work I enjoy most sits in cyber security leadership and Microsoft cloud security.
Experience
IT Manager at Alliance SI
Jul 2026 – Present · Artarmon, NSW
Accountable for IT and cyber security company-wide; govern our MSP; own the Essential Eight ML2 uplift.
ICT Systems Administrator at Alliance SI
May 2025 – Jul 2026 · Artarmon, NSW
Implemented the Microsoft security controls behind our first ISO 27001 certification and surveillance audit; Essential Eight ML1 uplift; interim application control.
Service Desk Analyst at NRMA
Dec 2022 - May 2025 · Sydney Olympic Park, NSW
One of a six-person service desk team that migrated 500+ endpoints from SCCM to Intune across a 2,000+ staff hybrid environment; the team's macOS subject-matter expert.
Technical Support Specialist at Renew IT
Dec 2021 - Dec 2022 · Parramatta, NSW
Education & Certifications
Certifications
ISC2 Certified in Cybersecurity (CC) · 2025
Education
Bachelor of Information Technology (Networking) · 2019
Frameworks I've delivered against
Ready to Connect?
Always happy to talk cyber security leadership, Microsoft cloud security and compliance.