Senior Consultant – Manager| Cyber Operate | Application Security Specialist | KSA

Job Summary

This role involves defining and implementing secure software development lifecycle standards, embedding security into CI/CD pipelines, conducting in-depth application security assessments, and leading remediation efforts to ensure application security compliance.

Responsibilities

• Define secure SDLC, coding standards, and application security requirements aligned with NCA ECC, OWASP ASVS, and NIST SSDF.
• Establish security requirements and acceptance criteria for applications, including contract clauses and release checks.
• Maintain an application inventory with risk ratings for each application.
• Implement and optimize SAST, DAST, SCA, and secrets scanning tools in CI/CD pipelines such as Checkmarx, Fortify, Veracode, SonarQube, Snyk, and Burp Suite.
• Triage security tool findings, reduce noise, and provide developers with clear remediation guidance.
• Review container, infrastructure-as-code, and cloud-native deployments alongside DevOps teams.
• Conduct application security assessments including manual testing of authentication, authorization, and business logic.
• Lead threat modeling for new applications and major changes, and review third-party and SaaS applications before adoption.

Requirements

• 4-8+ years of experience.
• Bachelor’s degree in computer science, software engineering, or related field.
• Software development experience in at least one language such as Java, C#/.NET, JavaScript/TypeScript, or Python, with ability to read and review code.
• Hands-on experience with SAST, DAST, and SCA tools in development environments.
• Strong knowledge of OWASP Top 10, API Security Top 10, and ASVS.
• Experience with CI/CD pipelines and DevSecOps practices.
• Preferred experience includes mobile application security (OWASP MASVS/MASTG), cloud-native and container security (Kubernetes, Docker, infrastructure-as-code), payment or customer-facing platforms (PCI DSS awareness), and running a security champions program.
• Arabic language proficiency is preferred.
• At least one preferred certification: CSSLP, GWEB, OSWE; also valued are GWAPT, CASE, eWPT, Burp Suite Certified Practitioner.
• Familiarity with frameworks and standards: NCA ECC-2:2024, OWASP ASVS / SAMM / Top 10 / API Security Top 10, NIST SP 800-218 (SSDF), ISO/IEC 27001:2022 (A.8.25–A.8.29), PCI DSS v4.0 (awareness).

We refresh listings regularly, but some roles close early on the source platform.