Cybersecurity Assurance & Assessment Specialist

Role Overview

Security Assurance and Risk Management

• Lead security assessments, architecture reviews, vulnerability management, and assurance activities.
• Operate a structured security assurance framework covering control validation, coverage tracking, and continuous assurance.
• Manage risks from identification through remediation and validation.
• Translate technical findings into business-level risk statements and remediation plans.

Application, Cloud, and Infrastructure Security

• Assess web applications, APIs, mobile applications, cloud platforms, containers, and infrastructure.
• Identify business logic flaws, authentication weaknesses, privilege abuse, and modern attack techniques.
• Validate secure architectures, configuration baselines, and cloud-native security controls.
• Support secure SDLC and DevSecOps practices, including security testing and release controls.

Configuration Baselines and Hardening

• Define and maintain secure configuration baselines for operating systems, databases, network devices, cloud services, identity platforms, and security tools.
• Align baselines with CIS Benchmarks and organizational risk requirements.
• Implement automated configuration compliance checks and continuous monitoring.
• Review configurations for drift, misconfigurations, and unauthorized changes.
• Work with engineering and operations teams to enforce hardening standards and remediate deviations.

Architecture and Secure Design

• Lead security architecture and design reviews across applications, platforms, and integrations.
• Conduct threat modeling to identify attack paths, risks, and mitigation strategies.
• Ensure alignment with enterprise security architecture and Zero Trust principles.

Third-Party, Data Protection, and Resilience

• Assess vendors, SaaS providers, and external integrations.
• Validate data protection, encryption, and privacy controls for sensitive and regulated data.
• Support OT/ICS security reviews, red team exercises, and incident response simulations.

Governance, Compliance, and Reporting

• Maintain alignment with ISO 27001, NIST CSF, Qatar NIA, and QCSF requirements.
• Support internal and external audits with defensible, evidence-based controls.
• Define and report security metrics, KPIs, and executive dashboards.

Required Experience and Skills

• At least 8 years of experience in information security assessments and assurance.
• Strong expertise in application, API, mobile, and cloud security.
• Hands-on experience in penetration testing, vulnerability management, and security architecture reviews.
• Practical experience in system hardening, configuration baselines, and security control validation.
• Deep understanding of modern attack techniques and identity and authentication mechanisms.
• Ability to communicate technical risks to business stakeholders.

Preferred Certifications

• OSCP, OSEP, or OSWE certification is preferred.
• CISSP certification is preferred.
• Azure or GCP cloud security certification is preferred.
• IEC 62443 certification is preferred.