Security Analyst – VAPT & Penetration Testing

BAE Systems Strategic Aerospace Services WLL; Doha; On-site; QAR 180,000 - 300,000; Full time

Job summary

BAE Systems Strategic Aerospace Services WLL in Doha seeks a Security Analyst specializing in VAPT and penetration testing to assess enterprise IT environments, applications, networks, and cloud platforms.

You will conduct internal and external penetration tests, evaluate web applications and APIs, review code security, and prepare detailed reports with risk ratings and remediation guidance for technical teams.

Responsibilities

• Conduct internal and external penetration testing across networks, servers, and infrastructure.
• Perform web application and API penetration testing, including testing against OWASP vulnerabilities.
• Conduct vulnerability assessments and validate findings.
• Perform controlled exploitation to assess impact and severity of security weaknesses.
• Test security of network devices, firewalls, routers, switches, VPNs, load balancers and servers.
• Assess application security including authentication, authorization, session management, input validation and encryption.
• Review source code security and support SAST/DAST.
• Assess security of cloud environments and operating systems.
• Develop or automate testing activities using Python.
• Prepare detailed reports with evidence, risk ratings and remediation recommendations.
• Collaborate with teams to remediate vulnerabilities and perform retesting.
• Follow established testing methodologies and best practices.
• Support security teams to identify attack vectors and improve posture.

Skills

VAPT

Penetration Testing

Web App Security

API Security

Cloud Security

Security Automation

Python Scripting

Tools

Burp Suite

Nmap

Nessus

Metasploit

Wireshark

Kali Linux

Job description

BAE Systems Strategic Aerospace Services WLL | Full time

Security Analyst – VAPT & Penetration Testing

The candidate will be responsible for conducting comprehensive Vulnerability Assessment and Penetration Testing (VAPT) across enterprise IT environments, applications, networks, infrastructure, cloud platforms and security systems.

Key Responsibilities

• Conduct internal and external penetration testing across networks, servers, firewalls, endpoints and infrastructure.
  
• Perform web application and API penetration testing, including testing against OWASP vulnerabilities.
  
• Conduct vulnerability assessments and manually validate identified vulnerabilities and false positives.
  
• Perform controlled exploitation to determine the actual impact and severity of identified security weaknesses.
  
• Conduct security testing of network devices, firewalls, routers, switches, VPNs, load balancers and servers.
  
• Perform application security testing covering authentication, authorization, session management, input validation, encryption and business-logic vulnerabilities.
  
• Conduct source-code security reviews and support SAST/DAST activities.
  
• Assess security of cloud environments and operating systems.
  
• Perform security assessments using tools such as Burp Suite, Nmap, Nessus, Metasploit, Wireshark and Kali Linux.
  
• Develop or automate penetration-testing/security activities using Python.
  
• Prepare detailed penetration-testing and vulnerability-assessment reports containing evidence, risk ratings, business impact and remediation recommendations.
  
• Work with technical teams to remediate identified vulnerabilities.
  
• Conduct retesting and validation after remediation.
  
• Follow established penetration-testing methodologies and cybersecurity best practices.
  
• Support security teams in identifying attack vectors and improving the organization's overall security posture.
  

Required Technical Skills

Strong hands-on knowledge of:

• Vulnerability Assessment & Penetration Testing (VAPT)
  
• API Security Testing
  
• Infrastructure Security Testing
  
• Cloud Security Testing
  
• OWASP Top 10
  
• SAST & DAST
  
• Source-Code Security Analysis
  
• Secure Coding Practices
  
• Network & Operating System Security
  
• Python/Security Automation
  
• Burp Suite
  
• Nmap
  
• Nessus
  
• Wireshark
  

Standards / Framework Knowledge

The candidate should have good knowledge of relevant cybersecurity standards and methodologies, including:

• OWASP
  
• NIST
  
• ISO/IEC 27001
  
• PCI DSS
  
• Penetration-testing methodologies and security best practices