Senior Consultant – Manager| Cyber Operate | Application Security Specialist | KSA

Role

Set secure development standards

• Define secure SDLC, secure coding standards, and application security requirements aligned with NCA ECC, OWASP ASVS, and NIST SSDF.
• Set application security requirements and acceptance criteria for internal and vendor-built applications, including contract clauses and release checks.
• Maintain an application inventory with risk ratings.

Integrate security and assess applications

• Implement and tune SAST, DAST, SCA, and secrets scanning in CI/CD pipelines; examples include Checkmarx, Fortify, Veracode, SonarQube, Snyk, and Burp Suite.
• Triage findings, reduce noise, and give developers actionable fix guidance.
• Review container, infrastructure-as-code, and cloud-native deployments with DevOps teams.
• Assess web, mobile, and API applications, including manual testing of authentication, authorization, and business logic.
• Review high-risk code, lead threat modeling, and assess third-party and SaaS applications before adoption.

Remediation and knowledge sharing

• Track vulnerabilities with development teams and vendors, verify fixes before release, and report application risk posture and trends to management.
• Train developers on secure coding, OWASP Top 10, and API Security Top 10; build a network of security champions.

Required qualifications

• 4–8+ years of total experience and a bachelor's degree in computer science, software engineering, or a related field.
• Software development background in at least one language, such as Java, C#/.NET, JavaScript/TypeScript, or Python, with ability to read and review code.
• Hands-on SAST, DAST, and SCA experience in development environments; knowledge of OWASP Top 10, API Security Top 10, and ASVS.
• Experience with CI/CD pipelines and DevSecOps practices.

Preferred qualifications

• Mobile application security experience, including OWASP MASVS/MASTG, is preferred.
• Cloud-native and container security, payment or customer-facing platform experience, PCI DSS awareness, and security champions programme experience are preferred.
• Arabic is preferred.
• At least one of CSSLP, GWEB, or OSWE is preferred; GWAPT, CASE, eWPT, and Burp Suite Certified Practitioner are also valued.
• Referenced frameworks include NCA ECC-2:2024, OWASP ASVS/SAMM/Top 10/API Security Top 10, NIST SP 800-218, ISO/IEC 27001:2022, and PCI DSS v4.0.

Leadership capabilities