Application Security Consultant

About the role

The Application Security Consultant will evaluate the security of web, mobile and enterprise applications used by government entities, identify weaknesses, and provide actionable recommendations to align with Saudi cybersecurity regulations and best‑practice DevSecOps processes.

Key responsibilities

• Perform application security assessments, architecture reviews and vulnerability analysis for web, mobile and enterprise solutions.
• Identify misconfigurations, architectural risks and map findings to NCA Essential Cybersecurity Controls, SAMA Cybersecurity Framework, PDPL and NDMO requirements.
• Execute security testing using SAST, DAST and basic penetration testing tools (e.g., Burp Suite, Fortify, Snyk).
• Validate remediation, track closure of findings and support audit readiness.
• Promote Secure SDLC (SSDLC) practices and integrate security into CI/CD pipelines (DevSecOps) within Azure DevOps environments.
• Prepare detailed assessment reports, remediation road‑maps and present findings to technical and non‑technical stakeholders.

Required profile

• Bachelor’s degree in Cybersecurity, Computer Science or a related field.
• 8+ years of experience in application security or cybersecurity consulting, preferably in government or regulated sectors.
• Preferred certifications: CISSP, CEH, OSCP, CSSLP, ISO 27001 Lead Implementer/Auditor.

Required skills

• Strong knowledge of OWASP Top 10 and application security principles.
• Hands‑on experience with SAST, DAST and tools such as Burp Suite, Fortify, Snyk.
• Familiarity with Secure SDLC, DevSecOps and CI/CD pipeline security.
• Experience with Azure cloud services and Azure DevOps pipelines.