Information security engineering specialist (Offensive Security Specialist)

BP p.l.c.; Malaysia; Hybrid; MYR 60,000 - 100,000; Full time

Job summary

Join a forward-thinking energy company as an Information Security Engineering Lead, where you will spearhead a team focused on offensive security. In this hybrid role, you'll oversee full-scale attack simulations, ensuring our security measures are robust and effective. Your expertise will guide the development of secure applications and enhance our cybersecurity posture. With a commitment to innovation and a diverse work environment, this role offers the chance to make a significant impact in protecting critical digital assets. If you're passionate about security and eager to shape the future of cybersecurity, this opportunity is perfect for you.

Qualifications

• 3+ years in security engineering or building security solutions.
• Strong knowledge in application security concepts and vulnerabilities.

Responsibilities

• Lead Red Team and Penetration Testing specialists.
• Define testing methodologies and shape the offensive security roadmap.
• Develop guidelines for secure API and cloud-native applications.

Skills

Security Engineering

Application Security

Cyber Security Principles

Secure Coding Best Practices

Continuous Learning

Education

Professional Security Certifications (CISSP, CISM, etc.)

Bachelor's Degree in Computer Science or related field

Tools

Code Scanning Tools (SAST, DAST, SCA)

CI/CD Pipelines

DevSecOps Tools

Cloud Environments (AWS, Azure, etc.)

Job description

Sign up to receive our monthly bp Energize newsletter and keep up to date on bp news, events, culture and role opportunities.

Information Security Engineering Specialist (Offensive Security Specialist)

• Travel required: No travel is expected with this role.
• Job category: IT&S Group
• Relocation available: This role is not eligible for relocation.

This team drives the response and management of cyber incidents, using an intelligence-led approach for identification, mitigation, and rapid response to safeguard bp on a global scale. By applying lessons learned and data analytics, they establish engineering principles and enhance the technology stack to continuously bolster bp's cybersecurity posture.

Let me tell you about the role

We are looking for an Information Security Engineering Lead (Offensive Security) who will lead a team of Red Team and Penetration Testing specialists. You will oversee full-scale attack simulations, from planning and execution to reporting and remediation insights, ensuring our controls are continually tested and improved. You will build relationships across security engineering, incident response, and leadership in different parts of the business.

As the Offensive Security Lead, you will define testing methodologies and shape the offensive security roadmap. You will also contribute to standard processes that will help shape bp’s security agenda and create a culture of excellence.

What you will deliver

• Provide technical expertise in support of information security and risk activities specific to the specialism to achieve objectives e.g. designing and developing security solutions to work across bp’s digital environments that are consistent with current policies.
• Maintain and improve the security aspects of the SDLC to help software engineering teams create products secure by design.
• Develop and promote guidelines for secure API and cloud-native applications.
• Maintain systems that are designed to uncover code vulnerabilities and provide remediation insights.
• Integrate security processes, such as threat modeling, static/dynamic analyses, and code reviews.
• Deliver the implementation and application of relevant operating processes and procedures, and ensure all activities adhere to the relevant standards.
• Evolve the security roadmap to meet anticipated future requirements and needs.
• Create and articulate materials on how to embed and measure security throughout the software and platform development lifecycle.
• Develop and maintain a series of internal and external collaborator relationships, delivering advanced technical knowledge to support project delivery, cooperatively identify key challenges and ensure that security solutions successfully protect bp against cyber risks.

What you will need to be successful (experience and qualifications)

• Seasoned security professional with 3+ years delivering security engineering services and/or building security solutions within a complex organization.
• Firm foundation of information and cyber security principles and standard processes.
• Solid knowledge in application security concepts (OWASP Top 10, secure coding best practices, common vulnerabilities, etc.).
• Professional and technical security certifications such as CISSP, CISM, GEVA, CEH, OSCP or equivalent are a plus.
• Development experience in one or more object-oriented programming languages (e.g., Python, Scala, Java, C#) and/or cloud environments (including AWS, Azure, Alibaba, etc.).
• Practical experience with code scanning tools (SAST, DAST, SCA).
• Experience with CI/CD pipelines and DevSecOps tools to automate security checks and integrate them into the development workflow.
• Operational proficiency in frameworks such as CIS CSC, NIST CSF, NIST 800-53, ISO 27001, etc.
• Foundational knowledge of security standards, industry laws, and regulations such as Payment Card Industry Data Security Standards (PCI-DSS), General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA) and Sarbanes-Oxley (SOX).
• Continuous learning and improvement approach.

About bp

bp is a global energy business with a purpose to reimagine energy for people and our planet. We aim to be a very different kind of energy company by 2030, helping the world reach net zero and improving people’s lives. We are committed to creating a diverse and inclusive environment where everyone can grow and succeed. Join bp and become part of the team building our future!

We will ensure that individuals with disabilities are provided reasonable accommodation to participate in the job application or interview process, to perform crucial job functions, and to receive other benefits and privileges of employment. Please contact us to request accommodation.

Job summary

Entity: Technology

Job Family Group: IT&S Group

Remote Type: This position is a hybrid of office/remote working.

Legal Disclaimer

We are an equal opportunity employer and value diversity at our company. We do not discriminate on the basis of race, religion, color, national origin, sex, gender, gender expression, sexual orientation, age, marital status, socioeconomic status, neurodiversity/neurocognitive functioning, veteran status or disability status. Individuals with an accessibility need may request an adjustment/accommodation related to bp’s recruiting process (e.g., accessing the job application, completing required assessments, participating in telephone screenings or interviews, etc.). If you would like to request an adjustment/accommodation related to the recruitment process, please contact us.