Vulnerability Assessment and Penetration Testing, Senior Engineer
SOOR • Riyadh, Saudi Arabia
The consulting firm is a cybersecurity subsidiary based in Riyadh, Saudi Arabia, focused on security assessments, secure infrastructure, and managed defense services. This senior role sits within the security services team and is client-facing, covering engagements across multiple industries.
The Role
The Senior Vulnerability Assessment and Penetration Testing Engineer leads complex security assessments for the consulting firm's clients. The position requires both technical depth and the ability to communicate findings clearly to non-technical stakeholders, including C-level executives and system administrators.
Required Experience and Qualifications
Preferred Certifications
Equivalent or additional certifications in offensive security are also considered relevant.
- Lead and execute penetration tests on web applications, covering OWASP Top 10, API security, and business logic flaws.
- Conduct network infrastructure penetration testing, including internal and external assessments, Active Directory, firewalls, and routers.
- Perform manual and tool-assisted secure code reviews (SAST) across languages and frameworks, identifying injection flaws and providing developer-focused remediation guidance.
- Conduct mobile application testing on iOS and Android using static and dynamic analysis.
- Run comprehensive vulnerability assessments and configuration reviews against CIS and NIST standards.
- Participate in red team exercises, adversary simulation, social engineering, and physical security assessments (optional, nice to have).
- Conduct cloud environment configuration reviews and exploitation across AWS, Azure, and GCP (optional, nice to have).
- Use and refine tools including Burp Suite Pro, Metasploit, Nmap, Nessus, and Bloodhound; develop custom scripts or exploits where automated tools are insufficient.
- Collaborate with clients to define engagement scope, rules of engagement, and timelines.
- Serve as the primary technical contact during engagements, providing status updates and immediate alerts on critical findings.
- Write executive-level reports that translate technical vulnerabilities into business risk, with clear remediation guidance for technical teams.
- Lead technical debrief sessions and remediation workshops with client stakeholders.
- Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related field.
- Five or more years of experience in information security, with at least three years specifically in penetration testing or VAPT roles.
- Prior experience in a consulting or service provider environment, managing multiple clients and timesheets, is strongly preferred.
- Deep understanding of web technologies including HTTP, SOAP, REST, and AJAX, and secure coding practices.
- Strong knowledge of Active Directory attack paths, including Kerberoasting, DCSync, and ACL abuse.
- Demonstrated manual exploitation capability beyond running automated scanners.
- Proficiency in at least one scripting language: Python, PowerShell, Bash, or Ruby, for automation and tool customisation.
- eMAPT
- eWPTX
- eCPTX
- OSCP
- CWEE