Vulnerability Assessment and Penetration Testing, Senior Engineer

Master-Works; Riyadh; In loco; SAR 350.000 - 550.000; Tempo pieno

Descrizione del lavoro

SOOR, a subsidiary of Master Works, seeks a Senior Vulnerability Assessment and Penetration Testing Engineer to lead complex security assessments across industries. This client-facing role requires translating technical findings into business risk and guiding remediation.

You will own end-to-end testing across web apps, networks, mobile apps, and cloud, collaborating with clients to define scope, RoE, and timelines while delivering executive-level reports and workshops.

Competenze

• Bachelor’s degree in CS/IT/Cybersecurity.
• 5+ years in information security; 3+ years in pentesting/VAPT.
• Experience in consulting/service provider environments preferred.

Mansioni

• Lead end-to-end penetration tests on web apps, networks, and mobile apps.
• Articulate business risks to stakeholders and guide remediation.
• Create executive-level reports translating vulnerabilities to risk.
• Collaborate with clients to define scope and RoE and timelines.
• Provide debriefs and remediation workshops with client stakeholders.

Conoscenze

Penetration testing

VAPT

Security reporting

Client communication

Formazione

Bachelor’s degree in CS/IT/Cybersecurity

Strumenti

Burp Suite Pro

Metasploit

Nmap

Nessus

BloodHound

Descrizione del lavoro

SOOR, a subsidiary of Master Works, helps organizations stay ahead of evolving cyber threats through advanced cybersecurity and secure infrastructure solutions. SOOR delivers resilient, scalable, and regulation-aligned security across governance, cloud, networks, and managed defense.

SOOR is looking for a highly skilled Vulnerability Assessment and Penetration Testing Engineer, Senior to join our dynamic security services team. In this client-facing role, you will be responsible for leading complex security assessments across various industries. You will act as a subject matter expert, not only identifying critical vulnerabilities but also articulating business risks to stakeholders and guiding remediation efforts.

Key Responsibilities

Penetration Testing: Lead and execute end-to-end penetration tests on:

• Web Applications: (OWASP Top 10, API security, Business Logic flaws).

• Network Infrastructure: (Internal/External, Active Directory, Firewalls, Routers, etc).

• Source Code Review: Conduct manual and tool-assisted secure code reviews (SAST) across languages/frameworks, identify injection flaws, and provide developer-focused remediation guidance.

• Mobile Applications: (iOS and Android - static and dynamic analysis).

• Vulnerability Assessment: Conduct comprehensive vulnerability assessments and configuration reviews against industry standards (CIS, NIST).

• Red Teaming (Optional/Nice to Have): Participate in adversary simulation exercises, social engineering, and physical security assessments.

• Cloud Environments (Optional/Nice to Have): (AWS, Azure, GCP configuration reviews and exploitation).

• Tooling: Utilize and refine advanced tooling (Burp Suite Pro, Metasploit, Nmap, Nessus, Bloodhound, etc.) and develop custom scripts/exploits when automated tools fail.

• Client Engagement & Consulting:

• Scoping: Collaborate with clients to define engagement scope, rules of engagement (RoE), and timelines.

• Communication: Serve as the primary technical point of contact during engagements, providing status updates and immediate alerts on critical “showstopper” findings.

• Reporting: Author high-quality, executive-level reports that translate technical vulnerabilities into business risks. Must be able to explain the “So What?” to C-level executives and the “How To Fix It” to system administrators.

• Debriefs: Lead technical read-out sessions and remediation workshops with client stakeholders.

• Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, or a related field

• 5+ years of experience in information security, with at least 3+ years specifically in a penetration testing/VAPT role.

• Prior experience working in a consulting/service provider environment is highly preferred (managing multiple clients and timesheets).

Technical Proficiency:

• Deep understanding of web technologies (HTTP, SOAP, REST, AJAX) and secure coding practices.
• Strong knowledge of Active Directory attack paths (Kerberoasting, DCSync, ACL abuse).
• Experience with manual exploitation techniques; not just running automated scanners.
• Proficiency in at least one scripting language (Python, PowerShell, Bash, or Ruby) for automation and tool customization.

Certifications (Preferred but not limited to):

• eMAPT
• eWPTX
• eCPTX
• OSCP
• CWEE, etc.