Consultant - Cybersecurity, Penetration Testing

Elm Company; Riyadh; On-site; SAR 180,000 - 280,000; Full time

Job summary

Elm Company in Riyadh is seeking a Consultant responsible for planning and executing authorized penetration testing across applications, infrastructure, and cloud environments. You will provide technical analysis, remediation advice, and validate corrective actions to strengthen cybersecurity posture.

The role requires 4–6 years of pentesting/offensive security, a related Bachelor’s degree, and professional certifications.

Qualifications

• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, Computer Engineering, or a related field.
• 4–6 years of hands-on penetration testing, vulnerability assessment, or offensive security experience.
• Ability to document findings with evidence and risk context.
• Knowledge of testing tools and reporting processes.

Responsibilities

• Plan and execute authorized penetration tests across applications, infrastructure, and other agreed environments.
• Assess weaknesses, document reproducible evidence, and analyze risk and impact.
• Produce penetration testing reports with scope, findings, risk ratings, and remediation recommendations; communicate to stakeholders.
• Conduct retests to verify remediation actions and close findings.

Skills

Penetration testing

Vulnerability assessment

Offensive security

Technical reporting

Remediation validation

Education

Bachelor's degree

Professional certifications (offensive security)

Job description

ROLE PURPOSE

The aim is to state the overall significance of the job from the organization’s perspective. The role exists to support the identification and assessment of cybersecurity weaknesses through the planning and execution of authorized penetration testing engagements across applications, infrastructure, and other agreed technology environments. The role provides technical analysis and practical remediation recommendations, validates corrective actions, and contributes to the continuous improvement of penetration testing practices to strengthen the organization’s cybersecurity posture.

Overview

Job Description

Job Title

Consultant

Job Code

733155

Grade

I3

Group

Legal, Risk & Governance

Division

Technology

Department

Cybersecurity

Unit

PT&VA

ROLE PURPOSE

The aim is to state the overall significance of the job from the organization’s perspective. The role exists to support the identification and assessment of cybersecurity weaknesses through the planning and execution of authorized penetration testing engagements across applications, infrastructure, and other agreed technology environments. The role provides technical analysis and practical remediation recommendations, validates corrective actions, and contributes to the continuous improvement of penetration testing practices to strengthen the organization’s cybersecurity posture.

Key Accountabilities & Activities

• Engagement Scoping & Planning
• Define testing objectives, scope, prerequisites, and deliverables with asset owners and relevant cybersecurity stakeholders.
• Prepare engagement plans and rules of engagement covering authorization, permitted techniques, testing windows, and escalation arrangements.
• Assess testing risks and coordinate access and operational safeguards before commencing approved activities.
• Application & API Penetration Testing
• Perform authorized penetration testing of web applications, mobile applications, and APIs within the agreed scope.
• Assess authentication, authorization, session management, input handling, and business logic controls using manual and automated techniques.
• Validate identified weaknesses and document reproducible evidence and potential business impacts.
• Infrastructure & Platform Penetration Testing
• Assess in-scope internal and external networks, systems, and cloud environments for exploitable weaknesses and configuration gaps.
• Evaluate attack paths, privilege boundaries, and exposure of sensitive services through controlled testing within approved limits.
• Coordinate with technical owners to manage testing dependencies and promptly eliminate unexpected operational impacts.
• Vulnerability Validation & Risk Analysis
• Analyze testing results, remove false positives, and assess the exploitability and impact of confirmed findings.
• Prioritize findings using the approved risk assessment approach, considering asset criticality, exposure, and compensating controls.
• Identify related weaknesses and attack chains to explain potential impacts on critical services and information assets.
• Technical Reporting & Remediation Advisory
• Produce penetration testing reports covering scope, approach, findings, supporting evidence, risk ratings, and remediation recommendations.
• Communicate technical findings and business implications to asset owners and relevant stakeholders.
• Advise technical teams on practical corrective measures and clarify findings throughout remediation.
• Remediation Validation & Closure
• Conduct retesting to verify corrective actions and assess whether identified weaknesses have been adequately addressed.
• Maintain accurate finding status and supporting evidence, and upscale overdue or unresolved issues through established channels.
• Document residual weaknesses and provide technical input to formal closure or risk acceptance decisions by authorized owners.
• Testing Methods, Tools & Quality
• Maintain and improve testing procedures, checklists, and reusable scripts in line with approved methodologies.
• Evaluate testing tools and techniques in controlled environments and recommend improvements to coverage and efficiency.
• Review technical evidence and reports, share specialist knowledge, and provide guidance to colleagues to support consistent testing quality.
• Stakeholder Coordination & Technical Research
• Coordinate engagement schedules, dependencies, and deliverables with business stakeholders, technology teams, and external testing providers.
• Research emerging vulnerabilities and attack techniques relevant to the organization’s technology landscape and incorporate applicable scenarios into approved testing.
• Maintain engagement records and handle credentials, test data, and evidence securely throughout testing and closure.
• Policies, Processes & Procedures
• Follow all relevant departmental policies, processes, standard operating procedures, and instructions so that work is carried out in a controlled and consistent manner.
• Comply with all relevant safety, quality, and environmental management policies, procedures, and controls to ensure a healthy and safe work environment.
• Information Security
• Comply with all relevant information security practices and standards to ensure data integrity and confidentiality.

JOB SPECIFICATIONS

Academic And Professional Qualifications

• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, Computer Engineering, or a related field.
• Relevant professional certifications in penetration testing or offensive security are considered an advantage.

Years And Nature Of Experience

• 4–6 years of experience in penetration testing, vulnerability assessment, or offensive security, including hands‑on testing, technical reporting, and remediation validation