Information Security Engineer (Pen Tester)

Tweeq; Riyadh; On-site; SAR 48,000 - 120,000; Full time

Job summary

A leading fintech company in Saudi Arabia is seeking an Information Security Engineer to enhance security measures. The role involves conducting penetration testing, participating in red team exercises, and developing security awareness programs. Ideal candidates will possess a degree in IT or a related field with relevant experience, communication skills, and some programming knowledge. This position offers a significant opportunity to contribute to safeguarding advanced technology systems in a dynamic environment.

Qualifications

• 2-3 years experience working across teams to deliver solutions.
• Excellent communication and stakeholder management skills.
• Experience in conducting phishing simulations and awareness exercises.

Responsibilities

• Conduct both Dynamic and Static Application Security Testing.
• Participate in Red Team engagements to simulate real-world attacks.
• Produce high-quality assessment reports detailing technical findings.
• Develop tools to enhance offensive security capabilities.

Skills

Vulnerability Assessment

Penetration Testing

Red Teaming

Social Engineering

Programming (Bash, Python)

Education

Degree in Information Technology or related field

Job description

Overview

We are thrilled to announce an opportunity for a skilled Information Security Engineer to join our team and play a role in enhancing our security measures by utilizing your abilities and deep knowledge of information security methodologies. Paying attention to details and efficiently solving problems will be crucial in ensuring the safety of Tabby’s systems.

Department: InfoSec Monitoring
Location: KSA

Responsibilities

• Penetration Testing: Perform Dynamic Application Security Testing (DAST) and Static Application Security Testing (SAST) for Web, Mobile, and API applications. Plan and conduct Infrastructure Vulnerability Assessment and Penetration Testing of systems, switches, servers, and more.
• Adversary Simulation (Red Teaming): Participate in sophisticated Red Team engagements, emulating real-world threat actor TTPs to assess the detection and response capabilities of the Blue Team/SOC.
• Vulnerability & Application Security Analysis: Conduct both Dynamic (DAST) and Static (SAST) Application Security Testing, and perform systematic vulnerability assessments using automated tools combined with meticulous manual verification.
• Report Development: Produce actionable, high-quality assessment reports that clearly articulate technical findings, business risk, and remediation strategies for both technical implementers and non-technical executives.
• Control Evasion & Social Engineering: Conduct controlled offensive testing, including Breach & Attack Simulations (BAS) and targeted phishing campaigns, to assess the resilience and bypassability of technical and human controls.
• Tool Development & Reporting: Develop and maintain custom scripts and tools to enhance offensive security capabilities, and produce high-quality, actionable reports detailing discovered threats and validated vulnerabilities on an ongoing basis.
• Security Awareness: Experience in conducting phishing simulations and other awareness exercises to evaluate employee susceptibility to social engineering attacks and provide targeted training to enhance resilience.

Qualifications

• Degree in Information Technology, Computer Science, Software Engineering, or related field
• Knowledge of Information Technology security issues and approaches to manage information technology security in a fast-paced Fintech environment.
• Security Qualification Good to have: OSCP, GPEN, GWAPT, CRT or equivalent.
• Excellent communication, influencing and stakeholder management skills
• 2-3 years experience of working across teams to deliver solutions and generate high levels of internal buy-in
• Experience of working in a culturally diverse environment
• Knowledge of online technologies, payment methods, content delivery networks, REST APIs, microservices, and application development.
• Programming and scripting understanding (Bash, Python etc.)