NGO - IT Security Engineer

PayNet (Payments Network Malaysia); Kampung Malaysia Tambahan; On-site; MYR 180,000 - 320,000; Full time

Job summary

PayNet (Payments Network Malaysia) invites a senior security engineer to shape and continuously improve security controls protecting the Nexus Operator environment. You will apply hands-on security engineering to critical, high-availability payment infrastructure and influence decisions across cloud, applications and third-party integrations.

You'll work with engineering, technology operations and external security specialists to reduce cyber risk, build practical controls that enable delivery

Qualifications

• 8+ years in cyber security, information security or security engineering.
• Hands-on experience across security architecture, cloud security, application security.
• Experience with SOC or MSSP services and responding to security events.
• Ability to navigate regulated or high-availability technology environments.
• Clear communication of complex security issues to engineers and leadership.
• Certifications such as CISSP, CCSP, GIAC or equivalent; payments/financial services experience is a plus.

Responsibilities

• Design, implement and improve security controls across cloud, infrastructure and applications.
• Drive security reviews for technology projects, integrations, architecture changes and production releases.
• Own vulnerability identification, prioritisation and remediation tracking, validating weaknesses addressed.
• Work with SOC and MSSP partners to investigate security events, improve detection capabilities and incident response.
• Coordinate penetration testing and technical security assessments, translating findings into remediation actions.
• Support security governance, audits and regulatory assessments by providing technical risk analysis and evidence.

Skills

Security engineering

Cloud security

Application security

Vulnerability management

Threat detection

Security architecture

Security governance

SOC coordination

Job description

• Shape the security controls protecting technology that supports the Nexus Operator environment
• Apply security engineering expertise to critical, high-availability payment infrastructure
• Influence security decisions across cloud platforms, applications and third-party integrations
• Work closely with engineering, technology operations and external security specialists to reduce cyber risk
• Build practical security controls that enable technology delivery without compromising resilience or trust

Why Nexus Global Operator / Why Now

• Shape the security controls protecting technology that supports the Nexus Operator environment
• Apply security engineering expertise to critical, high-availability payment infrastructure
• Influence security decisions across cloud platforms, applications and third-party integrations
• Work closely with engineering, technology operations and external security specialists to reduce cyber risk
• Build practical security controls that enable technology delivery without compromising resilience or trust

TL;DR

• Own the engineering and continuous improvement of technical security controls across the Nexus Operator environment
• Drive secure-by-design practices across infrastructure, cloud platforms, applications and technology releases
• Lead vulnerability management and technical security assessments, prioritising remediation based on risk
• Work with SOC and MSSP partners to strengthen monitoring, detection and incident response
• Assess technical security risks and provide clear recommendations to technology leadership
• Build evidence that demonstrates security controls are implemented and operating effectively

Why This Role Matters

• Protect the confidentiality, integrity, availability and resilience of critical technology
• Identify security weaknesses before they become operational or customer-impacting incidents
• Ensure new platforms and technology changes incorporate appropriate security controls from the outset
• Strengthen cyber defence by connecting engineering, vulnerability management and threat detection
• Give technology leaders clear technical insight into security risks and remediation priorities

What You Will Actually Do

• Design, implement and continuously improve security controls across cloud, infrastructure and application environments
• Drive security reviews for technology projects, integrations, architecture changes and production releases
• Own vulnerability identification, prioritisation and remediation tracking, validating that material weaknesses are effectively addressed
• Work with SOC and MSSP partners to investigate security events, improve detection capabilities and coordinate technical incident response
• Coordinate penetration testing and technical security assessments, translating findings into practical remediation actions
• Support security governance, audits and regulatory assessments by providing technical risk analysis, control evidence and subject-matter expertise

Examples of This Role in Practice

• A critical release contains an unresolved vulnerability: assess its exploitability and business impact, recommend mitigating controls and elevate when the residual risk exceeds agreed tolerances
• The SOC flags suspicious activity in production: investigate the technical indicators, coordinate containment and bring in the right specialists when escalation is required
• A new cloud service is being introduced: review its architecture, challenge control gaps and define the security requirements required before production
• A penetration test identifies a weakness across multiple applications: determine the underlying issue and work with engineering teams on sustainable remediation
• An auditor requests evidence that a key security control is operating effectively: provide traceable technical evidence and address gaps before they become repeat findings

What Will Help You Succeed

• Bring 8+ years of experience across cyber security, information security or security engineering
• Demonstrate strong hands‑on experience across security architecture, cloud security, application security, vulnerability management and cyber defence
• Apply practical experience working with SOC or MSSP services and responding to significant security events
• Navigate regulated or high-availability technology environments with the judgment to identify and elevate material technical risks
• Communicate complex security issues clearly to engineers, technology leaders and non-security stakeholders
• Strengthen your technical expertise through certifications such as CISSP, CCSP, GIAC or equivalent, with payments or financial-services experience an advantage