Resident Engineer

The Resident Engineer will deliver focused, on-site program management for TNB's comprehensive Vulnerability Assessment and Penetration Testing (VAPT) initiative. This role emphasizes management and governance, while also possessing the technical knowledge to critically assess test outcomes.

As the primary coordinator, the Resident Engineer will liaise between TNB system owners, internal security teams, and designated VAPT service providers, ensuring that all VAPT efforts are methodically planned, executed, documented, and concluded in a consistent and verifiable manner.

Key Responsibilities

• Formulate and sustain the annual VAPT strategy and testing schedule that encompasses IT, cloud, application, and network assets, prioritized based on risk assessments. 

• Gather, define, and prioritize VAPT requests from business units and system owners, and establish the rules of engagement, authorization, and approvals for each engagement. 

• Confirm the pre-test readiness of the environment, including test accounts, rollback strategies, and safe-testing measures, especially for production and operational technology systems. 

• Oversee and track the daily execution of multiple simultaneous engagements across selected service providers. 

• Conduct quality assurance reviews of all VAPT reports, ensuring technical accuracy, adequate evidence, consistent risk ratings, and validation of false positives. 

• Maintain a centralized findings register and drive remediation efforts with system owners in accordance with TNB's remediation service level agreements based on severity. 

• Coordinate retesting and the formal closure of remediated findings, as well as manage the risk acceptance and exception processes. 

• Create monthly program reports and quarterly management dashboards that include key performance indicators, trend analyses, and recurring root cause analyses. 

• Assist with internal audits, external audits, and regulatory requirements by providing VAPT evidence and status updates. 

• Oversee the daily performance of appointed VAPT service providers and validate deliverables against the contracted scope. 

• Continuously enhance TNB's VAPT policies, methodologies, templates, and standard operating procedures. 

Requirements

• Bachelor’s Degree in Computer Science, Information Technology, Engineering, Cyber Security, or a related field. 

• At least [8] years of experience in ICT, with a minimum of [5] years in the cyber security domain. 

• A minimum of [3] years of hands-on experience in VAPT execution as a tester, team lead, or technical reviewer. 

• At least [3] years of experience managing security assessment projects and overseeing third-party service providers. 

• Demonstrated capability to manage multiple concurrent security testing engagements within a large, complex organization. 

• Familiarity with VAPT methodologies and standards, including OWASP Top 10 and Testing Guide, PTES, NIST SP 800-115, CVSS, and MITRE ATT&CK. 

• Understanding of ISO/IEC 27001, NIST CSF, the Malaysia Cyber Security Act 2024, and PDPA 2010. 

• Proficiency in both written and spoken Bahasa Malaysia and English, with the ability to generate management-level reports. 

• Malaysian citizenship, capable of passing TNB's security screening and signing a Non-Disclosure Agreement. 

Certification:

Mandatory — at least one (1) of the following: 

• CISSP, CISM, or CISA 

• OSCP, GPEN, GWAPT, or GXPN 

• CREST CRT / CCT, or CEH (Practical preferred) 

Added advantage: 

• Project management certifications — PMP or PRINCE2 Practitioner 

• OT / ICS security certifications — GICSP or IEC 62443 Cyber Security Practitioner 

• ISO/IEC 27001 Lead Implementer or Lead Auditor 

• Previous experience in utilities, energy, oil and gas, or other Critical National Information Infrastructure (CNII) sectors. 

• Familiarity with OT / ICS environments (SCADA, DCS, PLC, RTU) and the challenges associated with testing live control systems.

Deliverables:

• Annual VAPT strategy and testing schedule. 

• VAPT governance package — policy, methodology, templates, and standard operating procedures. 

• Scoping and authorization documentation for each engagement. 

• Quality-assured VAPT reports for every engagement. 

• A central findings register, kept up-to-date at all times. 

• Monthly program status reports and quarterly management dashboards. 

• Audit and regulatory evidence package, available upon request.