Data centres are creating a different kind of security posting. If you’re a guard in the Klang Valley or Johor, here is what the job looks like, what the standard training covers, what leading operators and Singapore do differently, and what that means for us.
If you’ve worked at a factory, mall or condominium, you know the rhythm: gate, patrol, log, repeat. A data centre looks similar from the outside, but the job behind the gate is different, and the skills it needs are not the ones most of us were first trained on.
The postings are multiplying
Cyberjaya is the country’s top data centre destination, with more than 22 existing facilities and 9 more upcoming.[1] EdgeConneX’s Cyberjaya campus has 67MW of capacity and plans to expand to 200MW across a 200,000 m² site.[2] Equinix will build a US$190 million (RM747 million) KL2 facility there, less than a kilometre from its existing KL1.[3] Digital Realty is also scaling up a three-site, 32MW campus.[4]
Johor is following. Bitdeer AI is leasing a 65MW data centre in Johor,[5] and industry analysts name Johor and Cyberjaya as the two hubs with multiple facilities under construction.[6] Across the country, data centre and cloud projects made up RM95.8 billion of approved investment in the first half of 2026, nearly 44% of the total.[7]
All of these sites need people at the door, in the lobby and on the patrol route.
What makes the job different
Security is layered, and every layer has rules. A data centre is protected in zones: perimeter, building entry, data hall, and finally the server cage. Access differs by zone and by role. A network technician may be allowed on the server floor but not into the security operations centre, and a guard may patrol common areas but not enter the cages.[8] Letting the wrong person into the wrong zone, even out of politeness, is exactly the kind of small mistake that becomes a serious incident.
Insiders are part of the threat model. One UK security provider has tightened its data centre procedures with an extra suitability review before deployment, stricter access control and briefings on spotting unusual behaviour and procedural red flags.[9] That is a company’s own claim about its service, but the direction is sound. At sites like these, the risk isn’t only a stranger climbing the fence.
Machines can be fooled. An industry report from a security technology vendor says threat actors are using 3D-printed face models, synthetic fingerprints and AI-generated biometric data to defeat access control.[10] Treat that as a vendor’s claim, but the lesson holds: a green light on a reader is not proof of identity.
AI is arriving in the control room. Industry commentary argues that cameras are passive sensors and control rooms drown in alerts, and proposes an “augmented guard force” in which AI detects and triages while humans decide and resolve.[11] If that model spreads, the guard’s value shifts from watching to judging.
What the standard training covers, and what it doesn’t
Every guard in Malaysia is expected to complete the Certified Security Guard (CSG) programme, co-regulated by KDN and PDRM and administered through PPKKM. One agency’s compliance guide describes it as covering emergency response, access control procedures, crowd management and incident reporting.[12] A CSG exam preparation guide lists guard duties, the legal framework, patrol and access control, observation and reporting, fire safety, first aid, emergency response and professional conduct.[13]
That is a solid foundation. It is also a general one. This article could not find any sign that the standard CSG syllabus includes data-centre-specific content such as zone-based access, cage-level protocols, spoofed-credential awareness or working with AI alerts. That gap is this writer’s reading of the public material, so check it against the official syllabus.
What works elsewhere, and what we haven’t seen here
Two caveats apply. First, hyperscale operators publish their global standards, and we can’t tell from public sources how fully each is applied at their Malaysian sites. Second, “not yet in Malaysia” below means this article found no public evidence of it in Malaysia’s guard training framework or regulations. Please treat it as a prompt to ask questions rather than a verdict.
Practices at leading operators
Pre-authorised access and independent tenant controls. Google has described allowing only staff on a pre-authorised list, a very small fraction of its employees, through the gates of its data centre campuses.[15] In third-party facilities it says it runs its own biometric systems, cameras and metal detectors, independent of the host operator’s layers.[14] For a guard at a Cyberjaya colocation site, the practical lesson is that different tenants may have different rules, and you need to know which rules apply to whom.
Escort-only visitors. Microsoft designates approved visitors as “Escort Only” on their badges. They must stay with their escorts at all times, and the escort is responsible for reviewing the visitor’s actions and access.[17] The guard’s job is to enforce this and to notice when it slips.
Control of devices and equipment. Microsoft allows only approved devices onto the datacentre floor.[17] Google uses metal detectors and video surveillance so that no equipment leaves the floor without authorisation.[16] Screening what goes in and what comes out is a distinct skill from checking IDs.
Biometrics plus a second factor. Microsoft requires two-factor authentication with biometrics to move through the building.[17] Google has described a biometric lock, possibly an iris scan, at the corridor into the data hall.[15] Given the spoofing concerns above, the guard is the human check on top of these systems.
Physical detection layers. Google describes vehicle barriers and laser-based intrusion detection on the data centre floor, alongside metal detectors and cameras.[14] Its earlier public material also describes laser-based underfloor intrusion detection and video monitored with analytics software.[15] Guards at sites with these systems need clear response procedures for the alarms they generate.
Vetted and trained guards. Google says its data centres are patrolled by experienced guards who have undergone rigorous background checks and training.[16] Nothing in what we found suggests Malaysian data centre guards receive data-centre-specific training as a standard.
Sector-level practices in Singapore
A tiered career ladder that links training to pay. Singapore’s Progressive Wage Model sets five levels, from Security Officer up to Chief Security Officer, each defined by training requirements, experience, job scope and a minimum basic salary.[18] Basic licensing modules include incident response, operating basic security equipment and performing remote surveillance functions.[19] Malaysia has moved in this direction on paper. A Progressive Wage Policy White Paper, inspired by Singapore’s model, was tabled in Parliament on 30 November 2023. However, an analysis by ISIS Malaysia noted that it stopped short of detailing skills progression pathways.[23] We could not confirm that a security-specific, tiered training-and-pay pathway is in force in Malaysia today.
Outcome-based contracting. In Singapore, outcome-based contracting means buyers specify expected performance levels instead of a headcount, which lets agencies propose better solutions.[20] Examples include CapitaLand, which cut security headcount by 10% and paid quarterly incentives to high-performing officers, and ESR-REIT, which cut one property from four officers to one by pairing them with technology.[21] This works both ways for guards. It rewards skilled officers, but it can reduce posts. Singapore pairs it with reskilling support, including a Career Conversion Programme that funds up to 90% of salary support for companies reskilling existing officers.[22] If Malaysian buyers move toward outcome-based contracts without upskilling support, the risk falls on guards.
Skills that matter at a data centre
These are the author’s view, drawn from the trends above:
- Zone discipline. Know who may go where, and hold that line politely but firmly, even with senior engineers.
- Identity verification beyond the reader. Check the person as well as the card or fingerprint, and watch for anyone slipping in behind an authorised person.
- Escort and device control. Enforce escort rules and know what may be brought in or taken out.
- Insider awareness. Notice behaviour that doesn’t fit, whether it comes from a contractor, a visitor or a colleague, and report it through the right channel.
- Precise logs and incident reports. At these sites, your record may be the evidence.
- Comfort with technology. Understand the CCTV, alarm and access systems you work with, and know when an alert needs escalating.
- Emergency judgement. A fire or environmental alarm in a facility full of equipment calls for following the site procedure exactly.
- Professional communication and confidentiality. You will deal with engineers, contractors and client staff. What you see on site stays on site.
Training you should expect, and ask for
Beyond CSG, a data centre posting should come with:
- A site induction with a zone map and access rules.
- A walk-through of the SOPs, not only a signature on them.
- Drills for fire, power or cooling alarms, unauthorised access and medical emergencies.
- Technology familiarisation on the actual systems you will use.
- An insider-threat and social-engineering briefing.
- Refreshers when procedures or systems change.
Agencies and clients bear the responsibility here. If the site asks more of the guard than a general post does, the training budget and the pay should reflect it. Singapore’s example shows the two can be tied together by design. That connects to the wage and licensing enforcement issues we keep returning to on this platform.
What you can do now
Ask your supervisor or agency what site-specific training exists before you deploy, and read the SOPs properly. Keep your CSG and other credentials current, and build the habits above: clean logs, calm communication and close observation. Guards who can explain why they stopped someone at a door, and write it up clearly, will be the ones data centre operators keep.
The gate looks the same. The job behind it isn’t.
This article is prepared exclusively for pakguard.online and may not be republished without written permission. Content is based on the public sources cited and is accurate as of the date of publication. Readers are advised to refer to original sources or relevant authorities for the latest information. pakguard.online accepts no liability for decisions made based on content on this site.
References
[1] Research and Markets. (20 January 2026). Malaysia data center market investment analysis & growth opportunities report 2026–2031. Business Wire.
Cyberjaya is the leading data centre destination, with more than 22 existing and 9 upcoming facilities.
https://www.businesswire.com/news/home/20260120461807/en/Malaysia-Data-Center-Market-Investment-Analysis-Growth-Opportunities-Report-2026-2031—ResearchAndMarkets.com
[2] Black Ridge Research. (2026). Top 5 data center companies in Malaysia 2026. Black Ridge Research.
EdgeConneX’s Cyberjaya campus: 67MW current capacity, planned expansion to 200MW.
https://www.blackridgeresearch.com/blog/latest-list-top-largest-data-center-companies-malaysia
[3] The Edge Malaysia. (12 May 2026). Equinix to build another data centre in Cyberjaya for US$190 mil. The Edge Malaysia.
Equinix’s KL2 investment, location and cabinet count.
https://theedgemalaysia.com/node/803181
[4] Data Centre Magazine. (9 June 2026). Cyberjaya: Digital Realty’s Malaysia data centre expansion. Data Centre Magazine.
Digital Realty’s three-site, 32MW Cyberjaya campus.
https://datacentremagazine.com/news/cyberjaya-digital-realtys-malaysia-data-centre-expansion
[5] DatacenterDynamics. (September 2026). Malaysia [news page]. DCD.
Bitdeer AI’s lease of a 65MW data centre in Johor (18 September 2026).
https://www.datacenterdynamics.com/en/tags/malaysia/
[6] Black Ridge Research. (2026). Top 5 upcoming data centers in Malaysia 2026. Black Ridge Research.
Johor and Cyberjaya as key hubs with multiple facilities under construction.
https://www.blackridgeresearch.com/blog/latest-list-upcoming-data-centers-malaysia
[7] Business Today. (14 September 2026). Malaysia Data Centre Task Force gets over 40 applications in 2026. Business Today.
RM95.8 billion in data centre and cloud approvals, nearly 44% of first-half 2026 approved investment.
https://www.businesstoday.com.my/2026/09/14/malaysia-data-centre-task-force-gets-over-40-applications-in-2026/
[8] Lumana. (2026). Data center security: Strategies for physical and digital protection. Lumana Blog.
Zone- and role-based access, with guards patrolling common areas but not entering server cages.
https://www.lumana.ai/blog/data-center-security-strategies-for-physical-and-digital-protection
[9] Imperial Security. (6 August 2026). Imperial Security strengthens warehouse security services with enhanced protection for AI data centres. ABNewswire/FinancialContent.
Additional guard suitability review, tighter access control and insider-threat briefings (company claim).
https://www.financialcontent.com/article/abnewswire-2026-8-6-imperial-security-strengthens-warehouse-security-services-with-enhanced-protection-for-ai-data-centres
[10] IntelliSee. (2026). The $7 trillion blind spot: Why data centers are spending billions on servers and almost nothing on physical security. IntelliSee.
Claim that threat actors use 3D-printed faces, synthetic fingerprints and AI-generated biometrics (vendor source).
https://intellisee.com/the-7-trillion-blind-spot-why-data-centers-are-spending-billions-on-servers-and-almost-nothing-on-physical-security/
[11] Disaster Recovery Journal. (2026). Reasoning AI set to transform physical security infrastructure in 2026. DRJ.
The “augmented guard force” model: AI detects and triages, humans decide.
https://drj.com/journal_main/reasoning-ai-physical-security-2026/
[12] Optimal Security. (n.d.). Security guard Malaysia: KDN licensed, PPKKM certified. Optimal Security.
CSG programme co-regulated by KDN and PDRM, covering emergency response, access control, crowd management and incident reporting (agency source).
https://www.optimalsecurity.com.my/security-guard-malaysia.php
[13] Open Exam Prep. (2026). Free CSG exam (Malaysia) practice test 2026. Open Exam Prep.
Outline of CSG exam content, including access control, reporting, fire safety, first aid and conduct (study-guide source).
https://open-exam-prep.com/practice/my-csg-certified-security-guard
[14] Google Cloud. (n.d.). Google infrastructure security design overview. Google Cloud Documentation.
Layers including biometric identification, metal detection, cameras, vehicle barriers and laser-based intrusion detection; independent Google-controlled measures in third-party data centres.
https://docs.cloud.google.com/docs/security/infrastructure/design
[15] DatacenterDynamics. (n.d.). Google’s defense in depth. DCD.
Pre-authorised access lists, biometric lock (possibly iris scan) and laser-based underfloor intrusion detection, as described in earlier Google public material.
https://www.datacenterdynamics.com/en/analysis/googles-defense-in-depth/
[16] Google. (n.d.). Google Workspace security whitepaper. Google Workspace.
Patrols by guards with background checks and training; metal detectors and video surveillance to prevent unauthorised removal of equipment.
https://workspace.google.com/intl/vi/learn-more/security/security-whitepaper/page-4
[17] Microsoft. (n.d.). Azure facilities, premises, and physical security. Microsoft Learn.
Escort-only visitor badges, escort responsibility, biometric two-factor authentication and approved-device rules.
https://learn.microsoft.com/en-us/azure/security/fundamentals/physical-security
[18] Temasek Polytechnic Security Industry Institute. (n.d.). Progressive Wage Model (PWM). Temasek Polytechnic.
Singapore’s five-level security career ladder defined by training, experience, job scope and minimum salary.
https://www.tp.edu.sg/research-and-industry/security-industry-institute/progressive-wage-model.html
[19] CCCS. (n.d.). PWM – Security: Progressive Wage Model (PWM). CCCS.
Basic licensing modules including incident response, access control equipment and remote surveillance (training-provider source).
https://cccs.edu.sg/pwm-progressive-wage-model/
[20] Singapore Police Force. (n.d.). Security outcome-based contracting. Singapore Police Force.
Definition and rationale for outcome-based contracting in security services.
https://www.police.gov.sg/Knowledge-Hub/Security-Contracting/Security-Outcome-Based-Contracting
[21] Singapore Police Force. (3 September 2021). Improving security and overcoming manpower constraints with outcome-based contracts. Singapore Police Force.
CapitaLand and ESR-REIT outcome-based contract examples, including headcount reductions and incentive payouts.
https://www.police.gov.sg/media-hub/news/2021/20210903_improving_security_and_overcoming_manpower_constraints_with_outcomebased_contracts
[22] Workforce Singapore. (n.d.). Security Productivity Initiative (SPI). Workforce Singapore.
Career Conversion Programme funding of up to 90% salary support for reskilling security officers.
https://www.wsg.gov.sg/home/employers-industry-partners/workforce-development-job-redesign/security-productivity-initiative
[23] Cheng, C., & Zhang, K. (2024). Malaysia’s Progressive Wage Policy [Policy brief]. Institute of Strategic and International Studies (ISIS) Malaysia.
Malaysia’s Progressive Wage Policy White Paper tabled 30 November 2023, inspired by Singapore’s model, without detailed skills progression pathways.
https://www.isis.org.my/wp-content/uploads/2024/03/Malaysias-Progressive-Wage-Policy-final.pdf
