Information Security Engineer - VAPT (Saudi National)

Description

Key Responsibilities

• **Penetration Testing**
• : Perform Dynamic Application Security Testing (DAST) and Static Application Security Testing (SAST) for Web, Mobile, and API applications.
• Plan and conduct Infrastructure Vulnerability Assessment and Penetration Testing of systems, switches, servers, and more.
• **Adversary Simulation (Red Teaming):**
• Participate in sophisticated Red Team
• engagements, emulating real-world threat actor Tactics, Techniques, and Procedures (TTPs) to assess the detection and response capabilities of the Blue Team/SOC.
• **Vulnerability & Application Security Analysis:**
• Conduct both Dynamic (DAST) and Static (SAST) Application Security Testing, and perform systematic vulnerability assessments using automated tools combined with meticulous manual verification.
• **Report Development:**
• Produce actionable, high-quality assessment reports that clearly articulate technical findings, business risk, and remediation strategies for both technical implementers and non-technical executives.
• **Control Evasion & Social Engineering:**
• Conduct controlled offensive testing, including Breach & Attack Simulations (BAS) and targeted phishing campaigns, to assess the resilience and bypassability of technical and human controls.
• **Tool Development & Reporting:**
• Develop and maintain custom scripts and tools to enhance offensive security capabilities, and produce high-quality, actionable reports detailing discovered threats and validated vulnerabilities on an ongoing basis.
• **Security Awareness**
• : Experience in conducting phishing simulations and other
• awareness exercises to evaluate employee susceptibility to social engineering attacks and provide targeted training to enhance resilience.

Skills, Knowledge & Expertise

• Degree in Information Technology, Computer Science, Software Engineering, or related field
• Knowledge of Information Technology security issues and approaches to manage
• Information Technology security with a fast paced Fintech environment.
• Security Qualification Good to have: Offensive Security Certified Professional (OSCP), GIAC Penetration Tester (GPEN), GIAC Web Application Penetration Tester (GWAPT), CREST Registered Penetration Tester (CRT) or equivalent.
• Excellent communication, influencing and stakeholder management skills
• 2-3 Experience of working across teams to deliver solutions and generate high levels of internal buy-in
• Experience of working in a culturally diverse environment
• Knowledge of online technologies, payment methods, content delivery networks, REST APIs, microservices, and application development.
• Programming and scripting understanding (Bash, Python etc.)