Senior Security Consultant

Robotico Digital Llp; Muscat; Sur place; OMR 39 000 - 84 000; Plein temps

Résumé du poste

Robotico Digital Llp is seeking a Senior Security Consultant in Muscat to lead penetration testing and security assessments across applications, APIs, infrastructure, and Kubernetes environments. You will identify vulnerabilities, validate fixes, and support compliance with banking security standards.

The role covers threat modelling, security testing across web, mobile, API and container platforms, and coordination with internal teams and external vendors.

Qualifications

• Minimum 7–9 years in cybersecurity with penetration testing and security assessments.
• Proven experience in Banking and Financial Services (BFSI), digital banking, mobile banking and payment systems.
• Exposure to regulatory compliance reviews and standards in banking security.

Responsabilités

• Perform web, mobile, API, network, container and Kubernetes penetration testing.
• Conduct Istio service mesh security assessments.
• Review operating systems, databases, firewalls and network-device configurations.
• Assess security architecture configurations, vulnerabilities and associated risks.
• Conduct threat modelling, security assessments and risk workshops.
• Coordinate internal and external penetration-testing vendors, including test planning, access coordination, findings validation, remediation tracking and retesting.
• Support security tool proof-of-concept (POC) activities and evaluate their effectiveness.
• Prepare technical assessment reports, executive summaries, risk ratings and remediation recommendations.
• Engage with application development, infrastructure, cloud and Information Security teams.
• Track remediation activities and validate closure of identified security findings

Connaissances

Web application security

Mobile application security

API and microservices security

Container and Kubernetes security

Istio service mesh

Network penetration testing

Configuration reviews

Security assessment and risk

Penetration-test vendor management

Threat modelling

Description du poste

Position Senior Security Consultant

7-9 years experience Full-time onsite Initial 1 year Location Muscat

JD

The Senior Security Consultant will conduct penetration testing and security assessments for business projects and change requests deployed in pre-production and production environments. The consultant will assess applications, APIs, infrastructure, networks, containers and Kubernetes environments, identify vulnerabilities and security risks, recommend remediation, validate corrective actions and support compliance with banking security standards and regulatory requirements.

Key responsibilities

• Perform web, mobile, API, network, container and Kubernetes penetration testing
• Conduct Istio service mesh security assessments
• Review operating systems, databases, firewalls and network-device configurations
• Assess security architecture configurations, vulnerabilities and associated risks
• Conduct threat modelling, security assessments and risk workshops
• Coordinate internal and external penetration-testing vendors, including test planning, access coordination, findings validation, remediation tracking and retesting
• Support security tool proof-of-concept (POC) activities and evaluate their effectiveness
• Prepare technical assessment reports, executive summaries, risk ratings and remediation recommendations
• Engage with application development, infrastructure, cloud and Information Security teams
• Track remediation activities and validate closure of identified security findings

Mandatory technical skills

• Skill area
• Required expertise

Web application security

• Grey-box penetration testing OWASP Top 10 SQL injection XSS CSRF SSRF IDOR authentication and session-management weaknesses business logic flaws

Mobile application security

• Android and iOS penetration testing secure storage and communication certificate pinning reverse engineering root jailbreak detection OWASP Mobile Top 10

API and microservices security

• API Gateway testing JWT authentication and authorisation rate limiting mTLS BOLA excessive data exposure and business logic bypass

Container and Kubernetes security

• Cluster worker-node control-plane namespace and workload assessments RBAC privilege escalation container escape image security and hardening

Istio service mesh

• mTLS authentication and authorisation policies ingress egress gateways service-to-service security and observability

Network penetration testing

• Internal external network attacks firewalls load balancers exposed services ingress points cloud workloads and network devices

Configuration reviews

• Linux Windows database servers middleware firewalls ACLs VPNs IDS IPS network segmentation logging and administrative access

Security assessment and risk

• Threat modelling vulnerability validation risk rating remediation recommendations risk workshops and reporting

Penetration-test vendor management

• Scoping test planning access coordination findings validation remediation tracking retesting and reporting

Experience requirements

Overall experience 79 years in cybersecurity penetration testing and security assessments Proven experience in Banking and Financial Services BFSI digital banking mobile banking and payment systems Exposure to SWIFT RTGS PCI DSS API security assessments and regulatory compliance reviews Hands-on experience with banking applications payment platforms digital banking systems and their business logic Experience in internal and external penetration testing security reporting risk workshops and POCs

Qualifications and certifications

• Graduate with following industry certifications are highly preferred OSCP Offensive Security Certified Professional OSEP Offensive Security Experienced Penetration Tester OSWE Offensive Security Web Expert CREST certifications CISSP Certified Information Systems Security Professional CISM Certified Information Security Manager CCSP Certified Cloud Security Professional CCSK Certificate of Cloud Security Knowledge GWAPT GIAC Web Application Penetration Tester GPEN GIAC Penetration Tester CKS Certified Kubernetes Security Specialist Equivalent relevant industry certifications
• Graduate with following industry certifications are highly preferred:
• OSCP Offensive Security Certified Professional
• OSEP Offensive Security Experienced Penetration Tester
• OSWE Offensive Security Web Expert
• CREST certifications
• CISSP Certified Information Systems Security Professional
• CISM Certified Information Security Manager
• CCSP Certified Cloud Security Professional
• CCSK Certificate of Cloud Security Knowledge
• GWAPT GIAC Web Application Penetration Tester
• GPEN GIAC Penetration Tester
• CKS Certified Kubernetes Security Specialist
• Equivalent relevant industry certifications