Associate I, Cybersecurity Testing and Assurance (Executive)
Summary
Cybersecurity role on Air Selangor's (Malaysian water utility) Testing & Assurance team: running vulnerability assessments, penetration tests and control validation across infrastructure, cloud, identity and OT environments, tracking remediation, running cyber resilience drills, and producing assessment reports and assurance updates.
About the role
We are looking for a cybersecurity professional to join our Cybersecurity Testing & Assurance team and contribute to strengthening the organisation’s cybersecurity posture and resilience.
In this role, you will be involved in vulnerability management, penetration testing, cybersecurity assessments and control validation, helping to identify security weaknesses, assess risks and ensure remediation actions are effectively implemented.
You will work closely with technology, business and external stakeholders across a diverse technology environment, including infrastructure, applications, cloud, identity and Operational Technology (OT), while supporting cyber resilience testing, assurance reporting and continuous improvement initiatives.
Key responsibilities
Conduct and coordinate vulnerability assessments, penetration testing and other cybersecurity testing activities using approved tools and methodologies.
Assess identified vulnerabilities and security weaknesses, including their risk, severity and remediation requirements.
Monitor remediation progress, validate the closure of security findings and follow up on outstanding corrective actions.
Conduct cybersecurity assessments and reviews across infrastructure, networks, applications, cloud, identity and OT environments.
Assess the implementation and effectiveness of cybersecurity controls against organisational requirements, relevant standards and industry best practices.
Identify security gaps and recurring control weaknesses, and recommend practical improvements to strengthen the organisation’s cybersecurity posture.
Support security assessments for new technologies, projects and selected third-party solutions or services.
Coordinate cyber drills, tabletop exercises and cyber resilience testing, including documenting lessons learnt and monitoring improvement actions.
Prepare clear and concise assessment reports, vulnerability dashboards, testing summaries and management updates.
Maintain accurate records of security findings, supporting evidence, remediation actions and testing activities.
Support cybersecurity-related audit, risk, regulatory and governance requirements.
Collaborate with Infrastructure, Network, Cloud, Application, OT, Risk, Compliance and external service providers to strengthen security controls and drive timely remediation.
What we're looking for
Qualification
Bachelor’s degree in Cybersecurity, Information Technology, Information Systems, or an equivalent technical or professional qualification.
Relevant professional certifications such as CEH, CPENT, CompTIA Security+, PenTest+, CISM, CRISC, or equivalent are an added advantage.
Experience
3 to 7 years of relevant cybersecurity experience, preferably with practical exposure to vulnerability management, penetration testing, cybersecurity assessments, security testing or cybersecurity assurance.
Exposure to Operational Technology (OT)/ICS environments, cyber resilience exercises or security assurance activities is an added advantage.
Knowledge
Good knowledge of vulnerability management, penetration testing, cybersecurity assessment, control validation and remediation management practices.
Good understanding of cybersecurity controls across infrastructure, network, cloud, applications and identity environments.
Understanding of cybersecurity risk management, security assessment methodologies and industry security practices.
Knowledge of relevant cybersecurity, risk, regulatory and data protection requirements.
Understanding of OT/ICS cybersecurity is an added advantage.
Skills
Hands-on familiarity with vulnerability scanning and security testing tools, penetration testing methodologies and remediation tracking processes.
Strong analytical and problem-solving skills, with the ability to assess vulnerabilities, identify control gaps and recommend practical remediation.
Ability to prepare clear and concise security assessment reports, vulnerability dashboards and management updates.
Strong communication and stakeholder management skills, with the ability to explain cybersecurity findings to both technical and non-technical stakeholders.
Good collaboration skills and ability to work effectively across Infrastructure, Network, Cloud, Application, OT, Risk, Compliance and external service providers.
Abilities
Ability to prioritise cybersecurity risks and remediation actions based on severity, business impact and control effectiveness.
Ability to work independently while collaborating effectively with multidisciplinary teams and external service providers.
Ability to manage multiple assessments, findings and remediation activities in a structured and timely manner.
Ability to handle confidential and sensitive information with integrity, discretion and sound judgement.
Proactive, detail-oriented and adaptable, with the ability to think critically and operate effectively in a changing cybersecurity environment.