Consultant - Cybersecurity, Penetration Testing

شركة علم; Riyadh; On-site; SAR 279,000 - 446,000; Full time

Job summary

شركة علم seeks a Consultant in Cybersecurity to lead authorized penetration testing across applications, infrastructure, and cloud environments. You will plan scopes, test controls, and document evidence with business impact assessments.

The role includes coordinating with asset owners, producing actionable remediation advice, and validating fixes through retesting to strengthen the organization’s security posture.

Qualifications

• Bachelor’s degree in Cybersecurity or related field.
• 4–6 years in penetration testing or offensive security.
• Professional certifications are an advantage.

Responsibilities

• Scope, plan, and coordinate penetration testing engagements.
• Perform web, mobile, and API testing within approved scope.
• Assess authentication and session management controls.
• Validate findings and document evidence and business impact.
• Produce technical reports with remediation guidance.
• Validate remediation through retesting and closure.

Skills

Penetration testing

Vulnerability assessment

Threat analysis

Education

Bachelor's degree in Cybersecurity

Penetration testing certifications (advantage)

Job description

Overview

Job Description

Job Title

Consultant

Job Code

733155

Grade

I3

Group

Legal, Risk & Governance

Division

Technology

Department

Cybersecurity

Unit

PT&VA

ROLE PURPOSE

The aim is to state the overall significance of the job from the organization’s perspective.

The role exists to support the identification and assessment of cybersecurity weaknesses through the planning and execution of authorized penetration testing engagements across applications, infrastructure, and other agreed technology environments. The role provides technical analysis and practical remediation recommendations, validates corrective actions, and contributes to the continuous improvement of penetration testing practices to strengthen the organization’s cybersecurity posture.

Key Accountabilities & Activities

Key Accountabilities Key Activities

• Engagement Scoping & Planning
• Define testing objectives, scope, prerequisites, and deliverables with asset owners and relevant cybersecurity stakeholders.
• Prepare engagement plans and rules of engagement covering authorization, permitted techniques, testing windows, and escalation arrangements.
• Assess testing risks and coordinate access and operational safeguards before commencing approved activities.
• Application & API Penetration Testing
• Perform authorized penetration testing of web applications, mobile applications, and APIs within the agreed scope.
• Assess authentication, authorization, session management, input handling, and business logic controls using manual and automated techniques.
• Validate identified weaknesses and document reproducible evidence and potential business impacts.
• Infrastructure & Platform Penetration Testing
• Assess in-scope internal and external networks, systems, and cloud environments for exploitable weaknesses and configuration gaps.
• Evaluate attack paths, privilege boundaries, and exposure of sensitive services through controlled testing within approved limits.
• Coordinate with technical owners to manage testing dependencies and promptly elevate unexpected operational impacts.
• Vulnerability Validation & Risk Analysis
• Analyze testing results, remove false positives, and assess the exploitability and impact of confirmed findings.
• Prioritize findings using the approved risk assessment approach, considering asset criticality, exposure, and compensating controls.
• Identify related weaknesses and attack chains to explain potential impacts on critical services and information assets.
• Technical Reporting & Remediation Advisory
• Produce penetration testing reports covering scope, approach, findings, supporting evidence, risk ratings, and remediation recommendations.
• Communicate technical findings and business implications to asset owners and relevant stakeholders.
• Advise technical teams on practical corrective measures and clarify findings throughout remediation.
• Remediation Validation & Closure
• Conduct retesting to verify corrective actions and assess whether identified weaknesses have been adequately addressed.
• Maintain accurate finding status and supporting evidence, and maintain anchor or unresolved issues through established channels.
• Document residual weaknesses and provide technical input to formal closure or risk acceptance decisions by authorized owners.
• Testing Methods, Tools & Quality
• Maintain and improve testing procedures, checklists, and reusable scripts in line with approved methodologies.
• Evaluate testing tools and techniques in controlled environments and recommend improvements to coverage and efficiency.
• Review technical evidence and reports, share specialist knowledge, and provide guidance to colleagues to support consistent testing quality.
• Stakeholder Coordination & Technical Research
• Coordinate engagement schedules, dependencies, and deliverables with business stakeholders, technology teams, and external testing providers.
• Research emerging vulnerabilities and attack techniques relevant to the organization’s technology landscape and incorporate applicable scenarios into approved testing.
• Maintain engagement records and handle credentials, test data, and evidence securely throughout testing and closure.
• Policies, Processes & Procedures
• Follow all relevant departmental policies, processes, standard operating procedures, and instructions so that work is carried out in a controlled and consistent manner.
• Comply with all relevant safety, quality, and environmental management policies, procedures, and controls to ensure a healthy and safe work environment.
• Information Security
• Comply with all relevant information security practices and standards to ensure data integrity and confidentiality.

JOB SPECIFICATIONS

Academic And Professional Qualifications

• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, Computer Engineering, or a related field.
• Relevant professional certifications in penetration testing or offensive security are considered an advantage.

Years And Nature Of Experience

• 4–6 years of experience in penetration testing, vulnerability assessment, or offensive security, including hands-on testing, technical reporting, and remediation validation