Why I still take on cyber security consulting work in Townsville, outside the day job

I get asked a version of this fairly often: I already have a full-time role as IT Manager at a school — why do I still take on cyber security consulting work around Townsville outside that?

The honest answer is that the day job and the consulting work come from the same place, but they don’t overlap. One is running the technology for a single, well-resourced organisation. The other is what happens when I keep running into the same problem everywhere else I look.

The pattern I kept seeing

Across roughly seventeen years around Townsville IT — starting with house calls as Townsville Computer Man, through a state-wide role supporting Queensland state schools, a few years as a volunteer Director with Northreach Community Care, and now running technology for an independent school — I’ve watched the same thing happen on repeat in small businesses, charities, churches and community organisations.

Someone competent sets the technology up. It works. Nobody is ever specifically tasked with coming back to it. Years pass. The person who set it up moves on, a shared admin login outlives three staff changes, multi-factor authentication is “mostly” turned on, and nobody can quite say who actually owns the Microsoft 365 tenant anymore. None of that is negligence — it’s what happens when technology decisions are made by people whose actual job is running a business, a parish or a charity, not managing an IT estate.

Larger organisations have a person, or a team, whose job is to notice this drift before it becomes a problem. Most small and volunteer-run organisations in Townsville don’t — and the ones carrying the most trust (donor records, banking access, parishioner data, a community’s confidence in an organisation’s name) often have the least capacity to keep watching it.

Why I do this through Suburban Secure, not the school

That gap is why I work as a cyber security consultant for Townsville businesses, charities and community organisations through Suburban Secure — separate from, and outside the hours of, my role at the school.

It’s scoped deliberately. Engagements are fixed-price reviews and projects, not an open-ended retainer — I’ve written about why that’s a deliberate choice, not just how I happen to run it. Most of it starts the same way a lot of the problems above start: a Leadership Technology Review that maps what actually exists — email, cloud, Wi-Fi, devices, backups — before anyone decides what to fix first.

If you want the fuller story of what actually pushed me to formalise this rather than just fix things as a favour when someone asked, I wrote that up separately: why Suburban Secure exists. Short version: watching the same unfinished DMARC record let someone impersonate a charity’s own domain, more than once, in a city the size of Townsville, is the kind of thing that stops feeling like bad luck and starts feeling like a gap worth actually closing.

What this looks like in practice

I’m not trying to be a Townsville business’s ongoing managed IT provider, and I say that upfront to anyone who reaches out. What I am trying to be is the person who can look at the whole picture — network, cloud, devices, email, the website nobody’s touched since 2019 — and give a business owner, board or volunteer leader a plain-English answer to “what’s actually risky here, and what should we do about it first.”

If that’s useful to your organisation, the Townsville-specific page on Suburban Secure is the best starting point, or you can just get in touch directly.