Application Security Consultant

About the role

The Application Security Consultant will evaluate the security of web, mobile and enterprise applications used by government entities, identify risks, and guide remediation to meet Saudi cybersecurity regulations. The role bridges security testing, compliance, and DevSecOps practices, especially within Azure environments.

Key responsibilities

• Assess applications for vulnerabilities, misconfigurations, and architectural weaknesses.
• Review APIs, integrations, data flows, authentication, authorization and data protection mechanisms.
• Conduct security testing using SAST, DAST and basic penetration testing tools.
• Perform risk assessments, classify findings, and track remediation.
• Map security findings to NCA Essential Cybersecurity Controls, SAMA Cybersecurity Framework, PDPL and NDMO requirements.
• Support Secure SDLC (SSDLC) and embed security into CI/CD pipelines (DevSecOps).
• Advise on Azure cloud and Azure DevOps security configurations.
• Prepare and present assessment reports, remediation roadmaps and audit‑readiness documentation.

Required profile

• Bachelor’s degree in Cybersecurity, Computer Science or a related field.
• 8+ years of experience in application security or cybersecurity consulting, preferably in government or regulated sectors.
• Preferred certifications: CISSP, CEH, OSCP, CSSLP, ISO 27001 Lead Implementer/Auditor.

Required skills

• Strong knowledge of OWASP Top 10 and application security principles.
• Experience with SAST and DAST tools such as Burp Suite, Fortify and Snyk.
• Familiarity with Secure SDLC and DevSecOps practices.
• Hands‑on experience with Azure cloud services and Azure DevOps pipelines.
• Understanding of Saudi regulations: NCA Essential Cybersecurity Controls, SAMA Cybersecurity Framework, PDPL and NDMO.