Resident Engineer

Lavu Tech Solutions; Kuala Lumpur; On-site; MYR 180,000 - 240,000; Full time

Job summary

Tenaga Nasional Berhad (TNB) seeks a Resident Engineer to provide on-site programme management for enterprise-wide VAPT. The role blends governance with technical depth to review and challenge test results.

You will coordinate between system owners, internal security teams and VAPT providers, ensuring engagements are planned, executed, reported and closed in a consistent, auditable manner.

Qualifications

• Bachelor’s degree in Computer Science, IT, Engineering, Cyber Security or equivalent.
• 8+ years ICT, with 5+ years cybersecurity experience.
• 3+ years hands-on VAPT delivery as tester/leader/reviewer.
• 3+ years experience managing security assessment projects and third-party providers.
• Proven ability to manage multiple concurrent security testing engagements.
• Knowledge of OWASP Top 10, PTES, NIST SP 800-115, CVSS, MITRE ATT&CK.
• Knowledge of ISO/IEC 27001, NIST CSF, Malaysia Cyber Security Act 2024 and PDPA.
• Proficient in Bahasa Malaysia and English.
• Malaysian citizen, able to pass security screening and NDA.

Responsibilities

• Develop and maintain the annual VAPT plan and testing calendar.
• Receive, scope and prioritise VAPT requests and prepare engagement approvals.
• Verify pre-test readiness, test accounts and safe-testing controls.
• Coordinate and monitor day-to-day execution of engagements.
• Perform QA review of VAPT reports for accuracy and risk consistency.
• Maintain a central findings register and drive remediation with owners.
• Coordinate retesting and closure of remediated findings.
• Produce monthly programme reports and quarterly dashboards.
• Support audits by providing VAPT evidence and status.
• Manage service providers and verify deliverables.
• Maintain and improve VAPT policy, methodology and SOPs.

Skills

VAPT management

Security testing

Project management

ISO/IEC 27001

Bahasa Malaysia & English

Education

Bachelor’s Degree in Computer Science or IT

Tools

VAPT methodologies

NIST/OWASP/PTES

Job description

The Resident Engineer shall provide dedicated, on-site programme management for TNB’s enterprise-wide Vulnerability Assessment and Penetration Testing (VAPT) programme. The role is management and governance focused, with sufficient technical depth to review and challenge test results.

The Resident Engineer acts as the single point of coordination between TNB system owners, internal security teams and appointed VAPT service providers, and is accountable for ensuring all VAPT engagements are planned, executed, reported and closed in a consistent and auditable manner.

Key Responsibilities

• Develop and maintain the annual VAPT plan and testing calendar covering IT, cloud, application and network assets, prioritised on a risk basis.
• Receive, scope and prioritise VAPT requests from business units and system owners, and prepare the rules of engagement, test authorisation and approvals for each engagement.
• Verify pre-test readiness environment, test accounts, rollback plans and safe-testing controls, particularly for production and OT systems.
• Coordinate and monitor day-to-day execution of multiple concurrent engagements across appointed service providers.
• Perform quality assurance review of all VAPT reports, including technical accuracy, evidence sufficiency, risk rating consistency and false-positive validation.
• Maintain a central findings register and drive remediation with system owners against TNB’s remediation SLA by severity.
• Coordinate retesting and formal closure of remediated findings, and administer the risk acceptance and exception process.
• Produce monthly programme reports and quarterly management dashboards, including KPIs, trend analysis and recurring root causes.
• Support internal audit, external audit and regulatory requirements by providing VAPT evidence and status.
• Manage the day-to-day performance of appointed VAPT service providers and verify deliverables against contracted scope.
• Maintain and continuously improve TNB’s VAPT policy, methodology, templates and standard operating procedures.

Requirements

• Bachelor’s Degree in Computer Science, Information Technology, Engineering, Cyber Security or equivalent.
• Minimum [8] years working experience in ICT, of which minimum [5] years in cyber security.
• Minimum [3] years hands-on experience in VAPT delivery as a tester, team lead or technical reviewer.
• Minimum [3] years experience managing security assessment projects and third‑party service providers.
• Proven ability to manage multiple concurrent security testing engagements in a large, complex organisation.
• Working knowledge of VAPT methodologies and standards: OWASP Top 10 and Testing Guide, PTES, NIST SP 800-115, CVSS and MITRE ATT&CK.
• Working knowledge of ISO/IEC 27001, NIST CSF, the Malaysia Cyber Security Act 2024 and PDPA 2010.
• Proficient in written and spoken Bahasa Malaysia and English, with the ability to produce management‑grade reports.
• Malaysian citizen, able to pass TNB security screening and execute a Non-Disclosure Agreement.

Certification:

• CISSP, CISM or CISA
• OSCP, GPEN, GWAPT or GXPN
• CREST CRT / CCT, or CEH (Practical preferred)

Added advantage:

• Project management — PMP or PRINCE2 Practitioner
• OT / ICS security — GICSP or IEC 62443 Cyber Security Practitioner
• ISO/IEC 27001 Lead Implementer or Lead Auditor
• Prior experience in utilities, energy, oil and gas, or other Critical National Information Infrastructure (CNII) sectors.
• Exposure to OT / ICS environments (SCADA, DCS, PLC, RTU) and the constraints of testing live control systems.

Deliverables:

• Annual VAPT plan and testing calendar.
• VAPT governance pack — policy, methodology, templates and SOP
• Scoping and authorisation documents for each engagement.
• Quality‑assured VAPT reports for each engagement.
• Central findings register, maintained and current at all times.
• Monthly programme status report and quarterly management dashboard.
• Audit and regulatory evidence pack, on demand.