Associate - Cybersecurity

PwC; Kuala Lumpur; On-site; MYR 60,000 - 90,000; Full time

Job summary

PwC Malaysia invites an Associate to help identify security weaknesses through penetration tests and broader cyber risk services, collaborating with engagement teams to remediate vulnerabilities across client environments. You’ll work with experienced practitioners to deliver technical assessments and clearly communicate findings to clients.

As the threat landscape evolves, you’ll contribute to both offensive and defensive security engagements, stay current with industry best practices, and

Qualifications

• Degree in Cybersecurity, Information Security, or a related field. Equivalent experience may be considered.
• 0–1 year of experience in offensive security, penetration testing, information security, or a related field preferred.

Responsibilities

• Support the planning and execution of penetration tests and offensive security assessments under guidance.
• Support a broad range of technical security assessments, including web/mobile testing, and network reviews.
• Assist in conducting security maturity assessments, gap analyses, and reviews against recognised frameworks (e.g., NIST, ISO 27001, MITRE ATT&CK).
• Identify, validate, and safely exploit vulnerabilities across networks, applications, and systems.
• Assist in setting up and using offensive security tools and testing environments.
• Conduct research on emerging vulnerabilities, exploits, and attack techniques.
• Contribute to broader cybersecurity engagements beyond pentesting as needed.
• Document findings clearly and provide actionable remediation recommendations.
• Handle sensitive client data and assessment results with confidentiality.
• Follow rules of engagement, testing methodologies, and risk management procedures.

Skills

Networking concepts

OS security configurations

Offensive security basics

Frameworks & standards

Analytical skills

Communication skills

Adaptable & agile

Education

Degree in Cybersecurity, Information Security, or related field

Tools

Burp Suite

Nmap

Metasploit

Job description

A career in our Cybersecurity practice will provide the opportunity to help clients strengthen their security posture through offensive security testing and broader cyber risk services. In this role, you'll support engagement teams in identifying, exploiting, and helping remediate security vulnerabilities across client environments — while remaining agile enough to contribute across a wider range of cybersecurity engagements beyond penetration testing.

You’ll work alongside experienced practitioners to deliver technical assessments, communicate findings clearly to clients, and continuously develop your offensive and defensive security skills. As the threat landscape evolves, you’ll play an integral part in helping our clients stay resilient against real-world adversaries.

To really stand out and make us fit for the future in a constantly changing world, each and every one of us at PwC needs to be a purpose-led and values-driven leader at every level. To help us achieve this, we have the PwC Professional — our global leadership development framework. It gives us a single set of expectations across our lines, geographies, and career paths, and provides transparency on the skills we need as individuals to be successful and progress in our careers, now and in the future.

As an Associate, you’ll work as part of a team of problem solvers, helping clients identify and address security weaknesses before real-world adversaries can exploit them.

PwC Professional skills and responsibilities for this level include but are not limited to:

• Support the planning and execution of penetration tests and offensive security assessments under the guidance of senior team members.
• Support a broad range of technical security assessments, including web and mobile application testing, network and infrastructure testing, and configuration reviews.
• Assist in conducting security maturity assessments, gap analyses, and reviews against recognised frameworks and standards (e.g., NIST, ISO 27001, MITRE ATT&CK).
• Identify, validate, and safely exploit vulnerabilities across networks, applications, and systems.
• Assist in the setup, configuration, and use of offensive security tools and testing environments.
• Conduct research on emerging vulnerabilities, exploits, and attack techniques to support ongoing assessments.
• Contribute to broader cybersecurity engagements beyond penetration testing (e.g., threat analysis and advisory work) as required.
• Document findings clearly and provide practical, actionable recommendations and remediation advice to clients.
• Handle sensitive client data and assessment results responsibly, maintaining strict confidentiality at all times.
• Follow established rules of engagement, testing methodologies, and risk management procedures.
• Keep up to date with the latest attack techniques, tools, vulnerabilities, and industry best practices.
• Communicate technical findings and recommendations confidently and clearly — both verbally and in written reports — to technical and non-technical audiences alike.
• Invite and give in-the-moment feedback in a constructive manner.
• Collaborate effectively within the team and share knowledge to strengthen collective capability.
• Uphold the firm's code of ethics and business conduct at all times.

Experience and Qualifications:

• Degree in Cybersecurity, Information Security, or a related field. Equivalent experience may be considered.
• 0–1 year of experience in offensive security, penetration testing, information security, or a related field preferred.

Skills and Competencies:

• Strong understanding of networking concepts and protocols (TCP/IP, DNS, HTTP, etc.).
• Working knowledge of common operating systems (Windows, Linux) and their security configurations.
• Foundational understanding of offensive security concepts (e.g., the penetration testing lifecycle, common attack techniques, and tools such as Burp Suite, Nmap, or Metasploit).
• Familiarity with cybersecurity frameworks and standards (e.g., NIST, MITRE ATT&CK, OWASP, ISO 27001).
• Strong analytical, problem-solving, and troubleshooting skills.
• Excellent written and verbal communication skills.
• Adaptable and agile — comfortable taking on varied tasks and learning quickly in a fast-paced environment.

Certifications:

• Relevant certifications such as CompTIA Security+, Certified Ethical Hacker (CEH), OSCP, PNPT, eJPT, or GIAC (e.g., GPEN, GSEC) are a plus.