Consultant Manager Cyber Operate Penetration Tester

Job description

Key Responsibilities

• Plan and Scope Engagements: Agree on scope, objectives, rules of engagement, and test windows with system owners, obtaining written authorization before testing. Select appropriate testing approaches (black-box, grey-box, white-box, external, internal, announced, unannounced) and follow defined methodologies (NIST SP 800-115, PTES, OWASP) while ensuring safety for live services.
• Conduct Penetration Tests: Perform tests on web applications and APIs (authentication, authorization, business logic, injection, session handling, API security per OWASP Testing Guide and ASVS), mobile applications (iOS, Android, back-ends per OWASP MASTG), internal and external networks (perimeter exposure, segmentation, lateral movement, privilege escalation), Active Directory and identity (attack paths, Kerberos weaknesses, misconfigurations, credential exposure), cloud environments (Azure, AWS, GCP for misconfigurations, excessive permissions, exposed services), and wireless/physical systems (corporate/guest Wi-Fi, physical access controls where authorized).
• Run Red and Purple Team Exercises (Senior): Plan and lead objective-based red team exercises emulating realistic threat actors, mapped to MITRE ATT&CK. Conduct purple team sessions with the Security Operations Center (SOC) to test and improve detection and response capabilities.
• Report and Drive Fixes: Write clear, risk-rated reports with evidence, attack narratives, practical remediation steps, and an executive summary. Brief technical teams and management on results, explaining business impact. Retest fixes, confirm closure, and pass validated findings to Vulnerability Management and Risk for tracking. Build reusable test cases, scripts, and checklists to enhance testing efficiency.
• Leadership Capabilities
• Develop an understanding of Deloitte's purpose and values, exploring opportunities for impact.
• Demonstrate commitment to personal learning and development, acting as a brand ambassador.
• Understand expectations and maintain personal accountability for performance.
• Actively develop effective communication and relationship-building skills.
• Understand how daily work contributes to team and business priorities.

Qualifications and Experience

• A minimum of 2-5 years of experience in penetration testing or a related cyber security field.
• Demonstrated capability in planning and executing various types of penetration tests.
• Experience with relevant methodologies such as NIST SP 800-115, PTES, and OWASP.
• Proficiency in reporting findings and driving remediation efforts.

Work Environment

• This is a full-time position based in Riyadh, Riyadh, within a professional services environment. The role involves working with diverse teams and clients to address complex cyber security challenges.