Senior Manager - Operational Technology Penetration Testing

CLP; Hong Kong; On-site; HKD 900,000 - 1,300,000; Full time

Job summary

CLP is seeking a Senior Manager of Operational Technology Penetration Testing to lead and uplift the OT Technical Assurance & Penetration Testing team in Hong Kong. You will manage engagements across OT assets, define safe testing windows, and collaborate with control room and engineering teams to minimise disruption while delivering clear findings to leadership.

The role requires 6+ years in cybersecurity with 4+ years OT pentesting, strong knowledge of OT stacks and protocols, and hands-on

Qualifications

• Bachelor's degree in Computer Science, Information Technology, or related field
• At least 6 years of cybersecurity experience including security assessment and penetration testing
• At least 4 years of OT penetration testing experience across production or pre-production IC systems
• Independent management experience covering penetration testing projects, planning, scoping, QA
• Strong understanding of OT stack and IC protocols in critical infrastructure contexts

Responsibilities

• Lead penetration testing and vulnerability assessments on OT systems (PLCs, SCADA, HMI, IEDs)
• Define safe rules of engagement, test plans, windows, and rollback procedures
• Coordinate with control room, plant operations, IT/OT teams and vendors to avoid disruption
• Prepare clear, actionable reports for technical and non-technical stakeholders
• Stay current with OT security threats and share knowledge with the team

Skills

OT pentest

Vulnerability assessment

Python

PowerShell

Wireshark

Zeek

MITRE ATT&CK IC

Active Directory

Lab testing

Strong communication

Education

Bachelor's degree in Computer Science or IT

Tools

Wireshark

Zeek

PowerShell

Python

Job description

Working Location: Kai Tak, Kowloon, Hong Kong

Employment Duration: Permanent

The role of Senior Manager Operational Technology (OT) Penetration Testing is to lead, manage, maintain, and uplift CLP’s OT Technical Assurance & Penetration Testing team. This is one of the most critical aspects of ensuring CLP’s OT security and cyber resilience.

Responsibilities

• Conduct penetration tests and vulnerability assessments on OT systems, including ICT, PLCs, SCADA, and related devices.
• Identify, document, and report security weaknesses, vulnerabilities, misconfigurations, and potential threats within OT environments under controlled conditions.
• Lead pre‑engagement risk assessments, define safe rules of engagement, test plans, test windows, no‑touch assets, methodologies and rollback plans; integrate with change control/MoC and permit‑to‑work/LOTO processes.
• Collaborate with control room, plant operations, IT and OT engineering, security teams and OEM vendors to ensure no disruption to operations during assessments.
• Prepare clear and actionable reports for both technical and non-technical stakeholders.
• Experience in testing across OT assets and protocols such as PLC/RTU, HMI/SCADA, historians, IEDs/relays, EWS, jump hosts/DMZ, and protocols such as Modbus/TCP, DNP3, IEC‑60870‑5‑104, IEC‑61850 (MMS/GOOSE), PROFINET, EtherNet/IP, OPC UA/DA, BACnet, Siemens S7comm, CODESYS.
• Experience with security tools (e.g., Wireshark with ICDissectors, Zeek on SPAN/TAP) and frameworks for OT environments (e.g., MITRE ATT&CK for IC).
• Understanding of relevant regulations and standards (e.g. HK protection of critical infrastructure, NIST, ISA/IEC 62443).
• Stay current with emerging IC security threats, vulnerabilities, attack techniques, security best practices and share knowledge with other security team members.
• Provide regular reports and assist with creating technical presentations for senior leadership.
• Work with relevant teams to help prioritise and have identified vulnerabilities remediated in a timely manner.

Requirements

• Bachelor's degree in Computer Science, Information Technology, or a related field.
• At least 6 years of experience in cybersecurity, including security assessment and penetration testing.
• At least 4 years of experience in Operational Technology penetration testing, vulnerability assessments across production or pre-production IC systems.
• Independent management experience covering penetration testing projects, including project planning, scoping, and quality assurance.
• Strong understanding of OT stack (e.g., IC protocols, PLCs/RTUs, critical infrastructure protection expectations).
• Experience performing both manual and automated penetration testing, using tools such as:
  • Read‑only/passive tooling (e.g., Wireshark with ICDissectors, Zeek on SPAN/TAP),protocol interrogation, and safe enumeration of PLC/RTU functions.
  • Scripting/automation with Python (e.g., scapy) and PowerShell for custom ICchecks and data handling.
  • Ability to design and work in a lab environment/digital twin environments for proof‑of‑concept and security testing.
• Experience reviewing Windows Active Directory security and IT/OT hybrid environments.
• Knowledge of scripting languages such as Python, Ruby, or PowerShell.
• Experience mapping to MITRE ATT&CK for IC, developing attack chains from IT to OT, and collaborating with SOC/defenders to validate detections.
• Excellent written and verbal communication skills, including the ability to gather and critically evaluate information and prepare written documents that clearly and concisely identify the issues presented and their proposed resolution.
• Knowledge of scripting languages such as Python, Ruby, or PowerShell.
• Ability to explain technical issues to non-technical stakeholders.
• Good command of spoken and written English.
• Embrace new ideas and approaches and be willing to learn and adapt to evolving technologies.
• Actively shares technical knowledge and insights with team members to foster a collaborative environment.

About Clp

CLP was founded in Hong Kong in 1901, at a time when electricity was still a novelty worldwide. Today we power millions of homes and businesses across the Asia-Pacific region with over 8,000 employees.In Hong Kong, we operate a vertically integrated electricity business providing a highly reliable supply of electricity to over 80% of the city’s population. Outside Hong Kong, we invest in the energy sector on the Chinese Mainland, in Australia, India, Taiwan Region and Thailand. Our business spans the electricity value chain ranging from power generation, transmission and distribution to retail and smart energy services. We have a diversified portfolio of generating assets that uses a wide range of fuels sources including nuclear, renewables, gas and coal. To meet the evolving needs of energy users in a world being reshaped by decarbonisation and digitalisation, we strive to embrace new opportunities and expand our horizons as we fulfil our purpose to Power Brighter Tomorrows.