Consultant - Vulnerability and Penetration Testing

Role Overview

We are seeking experienced consultants to join the Strategy and Planning (S&P) team at Protiviti Middle East. This role involves leading and executing a variety of client engagements, primarily focused on assessing and enhancing the security framework of clients' information systems. While based in Riyadh, Saudi Arabia, candidates must be prepared to travel across the Middle East to client sites.

Key Responsibilities

• Drive innovations in the Vulnerability and Penetration Testing (VAPT) program encompassing both technological and procedural improvements.
• Act as a Subject Matter Expert (SME) specializing in Attack & Penetration testing operations.
• Conduct authorized reviews of attack surfaces, penetration tests, and red team assessments targeting specific systems or platforms.
• Deliver clear, actionable assessment reports tailored to the audience, emphasizing practical recommendations grounded in robust risk management principles.
• Continuously update and enhance security standards and procedures to strengthen the client's security posture.
• Evaluate the adequacy of security policies, standards, and procedures against industry best practices.
• Contribute to building security-related knowledge bases and support business development activities.
• Mentor junior team members and offer constructive advice to peers.

Qualifications and Experience

• Bachelor’s degree in Computer Science or an equivalent qualification.
• 4 to 6 years of professional experience in information security with a focus on technical security assessments.
• Deep understanding of penetration testing methodologies and industry best practices.
• Proficient with common penetration testing tools such as Nessus, Appscan, Burp Suite, Nipper, and Exploit Pack.
• Experienced in using attack frameworks and tools including Wireshark, Kali Linux, and Metasploit.
• Skilled at accurately verifying vulnerabilities discovered during assessments.
• Strong command of application platforms and technologies to perform detailed manual assessments using proxies, browser plugins, and other tools.
• Comprehensive knowledge of OWASP standards, CVE security controls, and current exploits targeting applications and operating systems.
• Familiarity with scripting/programming languages including Python and shell scripting.
• Professional certifications such as GIAC GPEN, GWAPT, CREST, or OSCE are preferred.

Personal Attributes

• Ability to maintain critical thinking and calmness under pressure.
• Excellent written and verbal communication skills in English, capable of explaining complex security issues to business stakeholders.
• Highly self-motivated and able to sustain productivity with minimal supervision.
• Possesses a clear understanding of how VAPT integrates with risk management and organizational priorities.