Cyber Security DevOps Lead

Riyad Bank; Riyadh; On-site; SAR 180,000 - 260,000; Full time

Job summary

Riyad Bank is seeking an experienced cybersecurity professional to assist, review, and validate cybersecurity requirements across development activities within Business Technology. You will support automated testing of controls in the DevOps pipeline, conduct vulnerability assessments, and ensure security is embedded in agile delivery.

The role requires 6–8 years in IT or Cyber Security and a Bachelor’s degree in Computer Science or IT.

Qualifications

• Bachelor's degree in Computer Science, Information Technology or equivalent.
• 6-8 years of relevant IT or Cyber Security experience (SOC, incident response, vulnerability management, penetration test, red teaming).
• Experience across security reviews in DevOps and agile environments.

Responsibilities

• Follows policies and SOPs to ensure controlled, consistent work.
• Supports projects by preparing technical plans applying cybersecurity and DevOps design principles.
• Selects testing approaches for automated cybersecurity controls in the DevOps pipeline.
• Analyses test activities, results, risks, and progress of cybersecurity initiatives.
• Manages configuration items for cybersecurity controls within the DevOps pipeline.
• Develops and maintains tools to track and log cybersecurity information in the DevOps pipeline.
• Performs vulnerability scanning, baseline configuration checks, and security testing.
• Secures software acceptance criteria, risk acceptance, and independent testing methods.
• Contributes to continuous improvement per international best practices.

Skills

Cybersecurity

DevOps

Security testing

Vulnerability management

Risk analysis

Code reviews

Static analysis

Fuzzing

Agile/Scrum

Education

Bachelor's degree in Computer Science or IT

Tools

Code scanning tools

Static analysis tools

Job description

To assist, review and validate in implementations of cybersecurity requirements across development activities in Business Technology.

Areas of responsibility:

• Follows all relevant departmental policies, processes, standard operating procedures and instructions so that work is carried out in a controlled and consistent manner
• Follows the day-to-day operations related to own job to ensure continuity of work
• Supports projects or change initiatives through the preparation of technical plans and application of cybersecurity and DevOps design principles.
• Selects appropriate testing approach for automated testing of cybersecurity controls and countermeasures in the DevOps pipeline.
• Analyses and reports on test activities, results, issues and risks, for the cybersecurity initiatives within the DevOps pipeline.
• Plans the capture and management of configuration items and related information for cybersecurity controls and countermeasures within the DevOps pipeline.
• Develops, configures and maintains tools (including automation) to identify, track, log and maintain accurate, complete and current information for cybersecurity controls and countermeasures within the DevOps pipeline.
• Reports on the status of configuration management. Identifies problems and issues to recommend corrective actions, and report on progress cybersecurity initiatives within the DevOps pipeline.
• Assesses and analyses release components for input to release scheduling, maintains and administers tools and methods for cybersecurity software delivery, deployment and configuration of the DevOps pipeline.
• Conducts vulnerability and baseline configuration scanning, change related penetration and security testing activities such as initial information gathering and standard probing; and engagement with engineering/ product teams to resolve identified security vulnerabilities
• Assists in ensuring security is embedded as part of the agile deployment covering sprint planning, defining security user stories and test cases, participating in scrum cadence and sprint retrospectives
• Use security testing and code scanning tools to conduct code reviews
• Perform secure program testing, review, and/or assessment to identify potential flaws in codes and mitigate vulnerabilities.
• Address security implications in the software acceptance phase including completion criteria, risk acceptance and documentation, common criteria, and methods of independent testing.
• Perform risk analysis (e.g., threat, vulnerability, and probability of occurrence) whenever an application or system undergoes a major change.
• Apply coding and testing standards, apply security testing tools including "'fuzzing" static-analysis code scanning tools, and conduct code reviews.
• Contributes to the identification of opportunities for continuous improvement of processes and practices taking into account ‘international best practice’, improvement of business processes, cost reduction and productivity improvement
• Assists in the preparation of timely and accurate reports of Riyad Bank to meet company and department requirements, policies and standards
• Complies with all relevant safety, quality and environmental management policies, procedures and controls to ensure a healthy and safe work environment
• Performs other related duties or assignments as directed within the confinement of the departmental roles and responsibilities.

Qualifications & experience:

Minimum Qualifications:

• Bachelor’s degree in Computer Science, Information Technology or equivalent.
• 6-8 years of relevant experience in IT or Cyber Security (SOC, incident response, vulnerability management, penetration test, red teaming)