VAPT Technical Lead

Human Resources Department of Ras Al Khaimah Government; Ras Al Khaimah; On-site; AED 200,000 - 300,000; Full time

Job summary

A governmental department in Ras al-Khaimah is seeking a qualified cybersecurity expert with a focus on vulnerability assessment and penetration testing (VAPT). The role requires a minimum of 7 years in the VAPT domain, along with relevant certifications such as OSCP and CEH. Candidates should possess strong analytical and scripting skills, coupled with the ability to communicate effectively with both technical and non-technical staff. Proficiency in English is essential, and knowledge of Arabic is preferred.

Qualifications

• Bachelor’s degree in cyber security or related fields required.
• Minimum 7 years of experience in the VAPT domain.
• English proficiency is essential; Arabic is a plus.

Responsibilities

• Conduct vulnerability scans and prioritize vulnerabilities based on risk.
• Manage remediation activities and report on vulnerability posture.
• Simulate real-world attack scenarios and evaluate system resilience.

Skills

Vulnerability assessment

Threat intelligence analysis

Incident response

Scripting and automation

Stakeholder management

Education

Bachelor’s degree in Cyber Security or related field

Tools

Qualys

Burp Suite

Nessus

Metasploit

Nmap

Job description

KEY ACCOUNTABILITIES & RESPONSIBILITIES

Performing regular vulnerability scans for all EGA IT Assets and prioritizing vulnerabilities based on risk.

Coordinating and supporting with IT Infrastructure teams for patch management and Web Application Development Teams for the code level remediations. Tracking and reporting on vulnerability posture.

Managing remediation activities from (EGA VAPT Program, Digital Forensics Operations, Security Performance Management Platforms, Trust.ae)

Collect, process, and analyze diverse threat intelligence to understand adversary tactics, techniques, and procedures (TTPs).

Formulate data-driven theories about potential hidden threats within the organization's environment.

Actively search through vast volumes of security logs and network data to uncover subtle malicious activities.

Develop specialized scripts and advanced queries to facilitate complex threat detection and analysis.

Generate clear vulnerability, intelligence reports and elevate confirmed threats to incident response teams with supporting forensic insights.

Provide critical feedback to improve existing security tools, detection rules, and overall defensive strategies.

Work closely with other security teams and leadership to communicate threat landscapes and enhance collective awareness.

Conduct Onsite Penetration Testing for EGA and its departments on site, on web applications, on Mobile Applications and APSs every Quarter in a year.

Manage VAPT engagements across networks, applications, cloud, and endpoints using industry-standard tools (e.g., Qualys, Burp Suite, Nessus, Metasploit, Nmap) and perform manual and automate Source Code Review of internally developed web applications. Manage end to end activity with the Web application Development team for the SSDLC (Secure Software Development Life Cycle)

Simulate real-world attack scenarios, developing threat models, and evaluating system resilience against advanced persistent threats (APTs).

Competent in producing clear, executive-level reports and technical documentation, articulating vulnerabilities, risks, and remediation strategies to both technical and non-technical stakeholders.

Stakeholder management and Team work: Managing the departmental collaboration within EGA IT and the Government Department IT Departments and the Government Departments themselves to promote security best practices and ensure vulnerabilities are understood and remediated effectively.

Incident Response: Collaborating with incident response teas suring security events and forensic investigations to, again, and ensure vulnerabilities are understood and remediated effectively.

Automation and AI : Using Vulnerability Scanning automation and AI tools AI to spot patterns and vulneraibilities that saves the information security team from unnecessary efforts.

QUALIFICATIONS & EXPERIENCE

Bachelor’s degree in cyber security or information security engineering, Electronic and Telecommunication Engineering, IT Engineering, Computer Engineering, or any relevant discipline

Preferred

Bachelor’s degree in cyber security or information security engineering, Electronic and Telecommunication Engineering, IT Engineering, Computer Engineering

Minimum 7 years of Experience on the VAPT Domain

Preferred : Preferred 10 years of Experience on the VAPT Domain

Certifications

OSCP, CEH and MS-AZ are prior to be acceptable but other certifications are acceptable as well.

Minimum 3 VAPT subject matter certification is required.

Preferred:

• Offensive Security Certified Professional (OSCP)
• Certified Ethical Hacker (CEH)
• GIAC Penetration Tester (GPEN)
• CompTIA PenTest+
• Microsoft Certified Azure Security Engineer Associate

English Language (spoken and written) – Essential, Arabic Language (spoken and written)