Cybersecurity Consultant – VAPT / Penetration Testing

Role overview

Employment and workplace

• Full-time, onsite position in Riyadh, Saudi Arabia.

Compensation

• Salary is up to SAR 18,000 per month, depending on experience and qualifications; the posting also lists a range of SAR 11,000–18,000 per month.

Responsibilities

• Test web applications, Android and iOS applications, and APIs for vulnerabilities.
• Conduct black-box and gray-box assessments, reconnaissance, external attack-surface discovery, and asset enumeration.
• Identify, validate, and document findings using manual and automated techniques; test within authorized scope.
• Assess applications against OWASP standards and recognized security methodologies.
• Prepare technical reports, executive summaries, and actionable remediation recommendations.
• Classify findings using CVSS and prioritize by severity and business impact.
• Retest fixes and communicate findings and security improvements with clients and technical teams.
• Support source code reviews and internal network assessments when required; maintain assessment documentation.

Required qualifications

• Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or a related field.
• 3–4 years of relevant penetration testing, vulnerability assessment, or application security experience.
• Hands-on web, mobile, and API penetration testing experience; experience with black-box and gray-box methods.
• Practical understanding of OWASP Top 10, WSTG, ASVS, and OWASP Mobile Security Testing methodologies.
• Familiarity with Burp Suite, Nmap, Nessus, Metasploit, and OWASP ZAP.
• Understanding of networking protocols, authentication, application vulnerabilities, and security controls.
• Strong analytical and troubleshooting ability, technical reporting and communication skills, and ability to manage assessments independently.

Preferred qualifications

• Cybersecurity certification such as OSCP, CEH, eWPT, or equivalent is preferred.
• Source code assessment, Active Directory or internal network testing, and familiarity with NIST SP 800-115, PTES, OSSTMM, or MITRE ATT&CK are preferred.
• Enterprise client or cybersecurity consulting experience and Arabic and English communication skills are preferred.