Application Security Consultant

About the role

The Application Security Consultant will evaluate the security of applications and digital environments within government entities, providing recommendations to enhance security posture and ensure compliance with Saudi cybersecurity regulations.

Key responsibilities

• Assess security of web, mobile, and enterprise applications, identifying vulnerabilities, misconfigurations, and architectural risks.
• Review application architecture, APIs, integrations, and data flows, evaluating authentication, authorization, and data protection mechanisms.
• Perform security testing using SAST, DAST, and basic penetration testing techniques.
• Conduct risk assessments, classify vulnerabilities, and validate remediation actions.
• Map findings to NCA Essential Cybersecurity Controls, SAMA Cybersecurity Framework, PDPL and NDMO requirements, supporting audit readiness.
• Promote Secure SDLC (SSDLC) practices and integrate security into CI/CD pipelines (DevSecOps), especially within Azure DevOps environments.
• Prepare and present security assessment reports, remediation recommendations, and improvement roadmaps to technical teams and stakeholders.

Required profile

• Bachelor’s degree in Cybersecurity, Computer Science or a related field.
• 8+ years of experience in application security or cybersecurity consulting.
• Experience in government or regulated environments is preferred.
• Relevant certifications such as CISSP, CEH, OSCP, CSSLP, ISO 27001 Lead Implementer/Auditor.

Required skills

• Deep knowledge of OWASP Top 10 and application security principles.
• Hands‑on experience with SAST and DAST tools (e.g., Burp Suite, Fortify, Snyk).
• Proficiency in Secure SDLC (SSDLC) and DevSecOps practices.
• Familiarity with Azure cloud services and Azure DevOps pipelines.
• Understanding of Saudi cybersecurity regulations (NCA Essential Cybersecurity Controls, SAMA Cybersecurity Framework, PDPL, NDMO).