Senior Consultant – Manager| Cyber Operate | Application Security Specialist | KSA

Deloitte Development LLC; Riyadh; On-site; SAR 260,000 - 420,000; Full time

Job summary

Deloitte Development LLC is seeking a Senior Consultant – Manager in Cyber Operate / Application Security Specialist for KSA. You will set secure development standards, embed security into CI/CD, and lead application security assessments and threat modelling.

The role requires strong governance, hands-on tool experience, and collaboration with architects and DevOps teams. You will train developers in secure coding, steer vulnerability remediation, and drive security posture across web, mobile,

Qualifications

• 4-8+ total years of experience in security and consulting.
• Bachelor's in computer science, software engineering or related field.
• Hands-on with SAST, DAST and SCA tools in real development environments.
• Strong knowledge of OWASP Top 10, API Security Top 10 and ASVS.
• Experience with CI/CD pipelines and DevSecOps practices.
• Mobile application security experience (OWASP MASVS/MASTG) preferred.
• Cloud-native and container security (Kubernetes, Docker, IaC) preferred.
• PCI DSS awareness is preferred; security champions programmes valued.
• Arabic language preferred; CSSLP, GWEB, OSWE or similar certifications desirable.

Responsibilities

• Define the secure development standard aligned with industry frameworks.
• Embed security in CI/CD pipelines and reduce release friction.
• Assess applications and perform secure code reviews as needed.
• Lead threats modelling and coordinate fixes withDevOps and developers.
• Train developers on secure coding and build security champions networks.

Skills

OWASP Top 10

API Security Top 10

ASVS

CI/CD pipelines

DevSecOps practices

Arabic language

Security champions programme

Education

Bachelor's in computer science, software engineering or a related field

Tools

SAST

DAST

SCA

Checkmarx

Fortify

Veracode

SonarQube

Snyk

Burp Suite

Kubernetes

Docker

Infrastructure as code

PCI DSS awareness

Job description

Senior Consultant – Manager| Cyber Operate | Application Security Specialist | KSA

About Deloitte : When you work for us, you commit to a career at one of the largest and most prestigious professional services firms in the world. We have received numerous awards over the last few years, including Best Employer in the Middle East, and Best Consulting Firm, and the Middle East Training & Development Excellence Award.

Our Purpose

Deloitte makes an impact that matters. Every day we challenge ourselves to do what matters most—for clients, for our people, and for society. We serve clients distinctively, bringing innovative insights, solving complex challenges and unlocking sustainable growth. We inspire our talented professionals to deliver outstanding value to clients, providing an exceptional career experience and an inclusive and collaborative culture. We contribute to society, building confidence and trust in the markets, upholding the integrity of organizations and supporting our communities.

Our shared values guide the way we behave to make a positive, enduring impact:

During your tenure as a Senior Consultant – Manager, you will demonstrate and develop your capabilities in the following areas.

Set the secure development standard

• Define the secure SDLC, secure coding standards and application security requirements, aligned with NCA ECC, OWASP ASVS and NIST SSDF
• Set security requirements and acceptance criteria for in-house and vendor-built applications, including contract clauses and release checks
• Build and maintain the application inventory, with a risk rating for each application

Embed security in the pipeline

• Implement and tune SAST, DAST, SCA and secrets scanning in CI/CD pipelines (e.g. Checkmarx, Fortify, Veracode, SonarQube, Snyk, Burp Suite)
• Triage tool findings, remove noise, and give developers clear, fix-ready guidance so security doesn't slow releases
• Review container, infrastructure-as-code and cloud-native deployments with DevOps teams

Assess applications in depth

• Run application security assessments of web, mobile and API applications, including manual testing of authentication, authorization and business logic
• Perform secure code reviews of high-risk features and components
• Lead threat modelling for new applications and major changes, working with architects and development teams
• Review third-party and SaaS applications before they are adopted

Drive fixes and build skills

• Track application vulnerabilities to closure with development teams and vendors; verify fixes before release
• Report application risk posture and trends to management
• Train developers on secure coding, OWASP Top 10 and API Security Top 10, and build a network of security champions in development teams

Leadership Capabilities:

• Builds own understanding of our purpose and values; explores opportunities for impact.
• Demonstrates strong commitment to personal learning and development; acts as a brand ambassador to help attract top talent.
• Understands expectations and demonstrates personal accountability for keeping performance on track.
• Actively focuses on developing effective communication and relationship-building skills.
• Understands how their daily work contributes to the priorities of the team and the business.

Qualifications:

• Years of experience: 4-8+ total years
• Bachelor's in computer science, software engineering or a related field
• Hands-on experience with SAST, DAST and SCA tools in real development environments
• Strong knowledge of OWASP Top 10, API Security Top 10 and ASVS
• Experience with CI/CD pipelines and DevSecOps practices
• Mobile application security experience (OWASP MASVS/MASTG) is preferred.
• Cloud-native and container security (Kubernetes, Docker, infrastructure-as-code) is preferred.
• Experience with payment or customer-facing platforms (PCI DSS awareness) is preferred.
• Experience running a security champions programme is preferred.
• Arabic Language is preferred.
• At least one preferred: CSSLP, GWEB, OSWE. Also valued: GWAPT, CASE, eWPT, Burp Suite Certified Practitioner.