Senior Security Consultant

Robotico Digital®; Muscat; On-site; OMR 42,000 - 66,000; Full time

Job summary

Robotico Digital® is seeking a Senior Security Consultant in Muscat for full-time onsite work. The role requires 7–9+ years of cybersecurity experience, focusing on penetration testing across web, mobile, API, and network environments, including Kubernetes and Istio security.

You will conduct security assessments, threat modelling and remediation planning, while coordinating internal teams and external vendors to ensure compliance with security standards.

Qualifications

• Senior Security Consultant with 7–9+ years in cybersecurity, penetration testing and security assessments.
• Experience in Banking/Financial Services, digital banking, payment systems and regulatory reviews.
• Hands-on with banking apps and payment platforms and their business logic.

Responsibilities

• Perform web, mobile, API, network, container and Kubernetes penetration testing.
• Conduct Istio service mesh security assessments.
• Review OS, databases, firewalls and device configurations.
• Assess security architecture, configurations, vulnerabilities and risks.
• Conduct threat modelling, risk workshops and remediation planning.
• Coordinate penetration-testing vendors, including test planning and retesting.
• Prepare technical assessments and remediation recommendations.
• Engage with development, infrastructure, cloud and security teams.
• Track remediation and validate closure of findings.

Skills

Grey-box testing

OWASP Top 10

SQL Injection

XSS

CSRF

SSRF

IDOR

Authentication security

Session management

Android & iOS pentesting

API security testing

Kubernetes security

Istio security

Network pentesting

System configuration review

Threat modelling

Vendor management

Tools

Penetration testing tools

POC evaluation

Reporting tools

Job description

Position: Senior Security Consultant

7–9+ years’ experience

Full-time onsite

Initial 1 year

Location: Muscat

1. Job description (JD)

The Senior Security Consultant will conduct penetration testing and security assessments for business projects and change requests deployed in pre-production and production environments. The consultant will assess applications, APIs, infrastructure, networks, containers and Kubernetes environments; identify vulnerabilities and security risks; recommend remediation; validate corrective actions; and support compliance with banking security standards and regulatory requirements.

Key responsibilities

• Perform web, mobile, API, network, container and Kubernetes penetration testing.
• Conduct Istio service mesh security assessments.
• Review operating systems, databases, firewalls and network-device configurations.
• Assess security architecture, configurations, vulnerabilities and associated risks.
• Conduct threat modelling, security assessments and risk workshops.
• Coordinate internal and external penetration-testing vendors, including test planning, access coordination, findings validation, remediation tracking and retesting.
• Support security tool proof-of-concept (POC) activities and evaluate their effectiveness.
• Prepare technical assessment reports, executive summaries, risk ratings and remediation recommendations.
• Engage with application development, infrastructure, cloud and Information Security teams.
• Track remediation activities and validate closure of identified security findings.

2. Mandatory technical skills

Skill area

Required expertise

Web application security

Grey-box penetration testing; OWASP Top 10; SQL injection, XSS, CSRF, SSRF, IDOR, authentication and session-management weaknesses, business logic flaws

Mobile application security

Android and iOS penetration testing; secure storage and communication; certificate pinning; reverse engineering; root/jailbreak detection; OWASP Mobile Top 10

API and microservices security

API Gateway testing, JWT, authentication and authorisation, rate limiting, mTLS, BOLA, excessive data exposure and business logic bypass

Container and Kubernetes security

Cluster, worker-node, control-plane, namespace and workload assessments; RBAC, privilege escalation, container escape, image security and hardening

Istio service mesh

mTLS, authentication and authorisation policies, ingress/egress gateways, service-to-service security and observability

Network penetration testing

Internal/external network attacks, firewalls, load balancers, exposed services, ingress points, cloud workloads and network devices

Configuration reviews

Linux, Windows, database servers, middleware, firewalls, ACLs, VPNs, IDS/IPS, network segmentation, logging and administrative access

Security assessment and risk

Threat modelling, vulnerability validation, risk rating, remediation recommendations, risk workshops and reporting

Penetration-test vendor management

Scoping, test planning, access coordination, findings validation, remediation tracking, retesting and reporting

3. Experience requirements

• Overall experience: 7–9+ years in cybersecurity, penetration testing and security assessments.
• Proven experience in Banking and Financial Services (BFSI), digital banking, mobile banking and payment systems.
• Exposure to SWIFT, RTGS, PCI DSS, API security assessments and regulatory compliance reviews.
• Hands‑on experience with banking applications, payment platforms, digital banking systems and their business logic.
• Experience in internal and external penetration testing, security reporting, risk workshops and POCs.

4. Qualifications and certifications

Graduate with following industry certifications are highly preferred:

• OSCP — Offensive Security Certified Professional
• OSEP — Offensive Security Experienced Penetration Tester
• OSWE — Offensive Security Web Expert
• CREST certifications
• CISSP — Certified Information Systems Security Professional
• CISM — Certified Information Security Manager
• CCSP — Certified Cloud Security Professional
• CCSK — Certificate of Cloud Security Knowledge
• GWAPT — GIAC Web Application Penetration Tester
• GPEN — GIAC Penetration Tester
• CKS — Certified Kubernetes Security Specialist
• Equivalent relevant industry certifications