Consultant – Manager| Cyber Operate | Penetration Tester | KSA

Role overview

Planning and testing

• Agree scope, objectives, rules of engagement, and test windows; obtain written authorisation before testing.
• Choose black-box, grey-box, or white-box approaches and external or internal testing, following recognised methods and protecting live services.
• Test web applications, APIs, iOS and Android apps, networks, Active Directory, Entra ID, Azure, AWS, GCP, Wi-Fi, and authorised physical access controls.
• Run authorised phishing and pretexting exercises with the Awareness team.

Red team and reporting

• At Senior level, lead objective-based red-team exercises mapped to MITRE ATT&CK and run purple-team sessions with the SOC.
• Produce risk-rated reports with evidence, attack narratives, practical fixes, and executive summaries; brief technical teams and management.
• Retest fixes, validate closure, pass findings to Vulnerability Management and Risk, and develop reusable tests, scripts, and checklists.

Qualifications

• 2–7 years of total experience and a bachelor’s degree in cybersecurity, computer science, or a related field, or equivalent practical experience.
• Hands-on penetration-testing experience for real organisations, beyond labs or CTFs.
• Strong skills with Burp Suite, Nmap, Metasploit, BloodHound, post-exploitation frameworks, and Python, Bash, or PowerShell scripting.
• Strong English report-writing skills.
• A recognised hands-on offensive certification, such as OSCP, is specified for Mid and Senior levels; the posting also identifies preferred certifications and other valued credentials.
• Red-team C2 experience, mobile or cloud penetration testing, exploit development or code review, and testing hospitality, payments, smart-city, or OT-adjacent environments are preferred; Arabic is preferred.

Methods and standards

• Methods and references include NIST SP 800-115, PTES, OWASP WSTG, ASVS, and MASTG, MITRE ATT&CK, and CREST methodology.
• Preferred certification examples include OSCP, CREST CRT/CCT, and GPEN; OSEP, OSWE, CRTO, GWAPT, eCPPT/eWPT, and PNPT are also valued. CEH is accepted at Junior level only.