Cybersecurity Assurance & Assessment Specialist

Employment; Doha; On-site; QAR 300,000 - 600,000; Full time

Job summary

Employment is seeking a Cybersecurity Assurance & Assessment Specialist to lead end-to-end security assurance across applications, cloud, and infrastructure, ensuring secure configurations and ongoing validation in line with ISO 27001 and NIST CSF.

You will drive risk-based assessments, threat modeling, and third-party security reviews, translating technical findings into business-friendly remediation plans for executive stakeholders.

Qualifications

• 8+ years of experience in information security assessments and assurance.
• Strong expertise in application, API, mobile, and cloud security.
• Hands-on experience in penetration testing, vulnerability management, and security architecture reviews.
• Practical experience in system hardening, configuration baselines, and security control validation.
• Deep understanding of modern attack techniques and identity/authentication mechanisms.
• Proven ability to communicate technical risks to business stakeholders.

Responsibilities

• Lead security assessments, architecture reviews, vulnerability management, and assurance activities.
• Assess web apps, APIs, mobile apps, clouds, containers, and infrastructure for security risks.
• Define secure configuration baselines and continuous hardening across OS, databases, and networks.
• Lead security architecture reviews and threat modeling across applications and platforms.
• Assess vendors, SaaS providers, and external integrations for data protection and privacy controls.
• Ensure alignment with ISO 27001, NIST CSF, Qatar NIA/QCSF; report security metrics to executives.

Skills

Security assessments

Threat modeling

Cloud security

Penetration testing

Vulnerability management

Secure design

Risk communication

Tools

CIS Benchmarks

Job description

Cybersecurity Assurance & Assessment Specialist

Industry Information Technology and Services

The Information Security Officer is responsible for leading and executing end-to-end security assurance activities across technology landscape, including applications, cloud, infrastructure, identity, and third-party environments.
The role ensures security controls are properly designed, implemented, validated, and continuously enforced, including the definition and verification of secure configuration baselines across the enterprise, in alignment with ISMS, NCSA (Qatar NIA/QCSF), ISO 27001, and NIST CSF.

Key Responsibilities

• Security Assurance & Risk Management: Lead security assessments, architecture reviews, vulnerability management, and assurance activities. Establish and operate a structured Security Assurance Framework covering control validation, coverage tracking, and continuous assurance. Manage the full security lifecycle from risk identification through remediation and validation. Translate technical findings into business-level risk statements and remediation plans.
• Application, Cloud & Infrastructure Security: Perform in-depth security assessments of web applications, APIs, mobile applications, cloud platforms, containers, and infrastructure. Identify advanced security risks such as business logic flaws, authentication weaknesses, privilege abuse, and modern attack techniques. Validate secure architectures, configuration baselines, and cloud-native security controls. Support secure SDLC and Dev Sec Ops practices, including security testing and release controls.
• Configuration Baselines & Continuous Hardening (New): Define and maintain secure configuration baselines across the enterprise technology stack (OS, databases, network devices, cloud services, identity platforms, and security tools). Align baselines with industry standards (e.g., CIS Benchmarks) and organizational risk requirements. Implement automated configuration compliance checks and continuous monitoring mechanisms. Conduct periodic reviews and validation of configurations to detect drift, misconfigurations, and unauthorized changes. Work with engineering and operations teams to enforce hardening standards and remediate deviations.
• Architecture, Threat Modeling & Secure Design: Lead security architecture and design reviews across applications, platforms, and integrations. Conduct threat modeling to identify attack paths, risks, and mitigation strategies. Ensure alignment with enterprise security architecture and Zero Trust principles.
• Third-Party, Data Protection & Resilience: Conduct security assessments of vendors, Saa S providers, and external integrations. Validate data protection, encryption, and privacy controls for sensitive and regulated data. Support cyber resilience activities, including OT/ICS security reviews, red team exercises, and incident response simulations.
• Governance, Compliance & Reporting: Ensure continuous alignment with regulatory and framework requirements (ISO 27001, NIST CSF, Qatar NIA, QCSF). Support internal and external audits with defensible, evidence-based controls. Define and report on security metrics, KPIs, and executive dashboards.

Required Experience & Skills

8+ years of experience in information security assessments and assurance. Strong expertise in application, API, mobile, and cloud security. Hands-on experience in penetration testing, vulnerability management, and security architecture reviews. Practical experience in system hardening, configuration baselines, and security control validation. Deep understanding of modern attack techniques and identity/authentication mechanisms. Proven ability to communicate technical risks to business stakeholders.

Preferred Certifications

OSCP / OSEP / OSWECISSPCloud Security Certifications (Azure / GCP) IEC 62443