Application Security Consultant Job

Elm Company; Riyadh; On-site; SAR 180,000 - 300,000; Full time

Job summary

Elm Company is seeking a Consultant in Riyadh to strengthen security across the software development lifecycle. You will lead application security assessments, review code for vulnerabilities, and model threats for new and existing applications and services.

The role requires 4–6 years of hands-on experience in application security and a relevant bachelor’s degree. Certifications are a plus, and you will collaborate with development teams to implement security controls and guidance.

Qualifications

• Bachelor's degree in Cybersecurity, CS, SWE, or related field.
• Professional certifications in Application Security or Secure Software Development are advantageous.
• 4–6 years of experience in application security or related cybersecurity domains.

Responsibilities

• Perform application security assessments for apps and digital solutions.
• Conduct secure code reviews to identify vulnerabilities.
• Conduct threat modeling for new and existing applications and services.
• Assess APIs and third‑party integrations for cybersecurity risks.
• Provide remediation guidance to development teams and monitor findings.

Skills

Application Security

Vulnerability Management

Threat Modeling

Secure Coding

Education

Bachelor's degree in Cybersecurity, CS, SWE, or related field

Job description

ROLE PURPOSE

The aim is to state the overall significance of the job from the organization’s perspective. The role exists to perform application security assessments and support the integration of security throughout the software development lifecycle by identifying application vulnerabilities, conducting code and design reviews, assessing APIs and integrations, and providing security guidance to development teams to strengthen the security of Elm's applications and digital solutions.

Overview

Job Title: Consultant

Job Code: 680865

Grade: I3

Division: Legal, Risk & Governance

Department: Cybersecurity

Unit: Application Security

Key Accountabilities & Activities

• Application Security Assessment
• Perform security assessments for applications and digital solutions.
• Evaluate applications against approved security requirements and standards.
• Document identified vulnerabilities, risks, and recommended remediation actions.
• Secure Code Review
• Conduct security-focused source code reviews to identify vulnerabilities and insecure coding practices.
• Assess code against secure coding standards and common application security risks.
• Provide remediation guidance to development teams.
• Threat Modeling
• Conduct threat modeling for new and existing applications and services.
• Identify potential attack scenarios, threats, and security control gaps.
• Recommend security controls based on identified risks.
• Application Vulnerability Management
• Identify, analyze, and assess application-layer vulnerabilities.
• Coordinate with development teams on vulnerability remediation activities.
• Validate remediation and monitor outstanding application security findings.
• API & Integration Security
• Assess APIs, microservices, and third-party integrations for cybersecurity risks.
• Evaluate authentication, authorization, data protection, and integration controls.
• Recommend appropriate security improvements.
• Secure Design & Development Advisory
• Provide security guidance to development and engineering teams throughout the development lifecycle.
• Support the application of secure design and development practices.
• Recommend security controls appropriate to solution risks and requirements.
• Application Security Standards & Frameworks
• Develop and maintain application security standards, guidelines, and technical requirements.
• Support alignment with secure software development practices and applicable cybersecurity standards.
• Evaluate emerging application security practices and recommend enhancements.
• Developer Security Awareness
• Support secure coding awareness and technical security training for developers.
• Develop security guidance and knowledge materials addressing common application vulnerabilities.
• Promote secure development practices across engineering teams.
• Policies, Processes & Procedures
• Follow all relevant departmental policies, processes, standard operating procedures, and instructions so that work is carried out in a controlled and consistent manner.
• Comply with all relevant safety, quality, and environmental management policies, procedures, and controls to ensure a healthy and safe work environment.
• Information Security
• Comply with all relevant information security practices and standards to ensure data integrity and confidentiality.

JOB SPECIFICATIONS

Academic And Professional Qualifications

• Bachelor's degree in Cybersecurity, Computer Science, Software Engineering, Computer Engineering, or a related field.
• Professional certifications in Application Security, Secure Software Development, or related cybersecurity disciplines are considered an advantage.

Years And Nature Of Experience

• 4–6 years of experience in application security, secure software development, security assessments, vulnerability management, or related cybersecurity domains.