Security Consultant – Application Security & Penetration Testing
Doha, Doha Municipality, Qatar · Full Time
Be the first to apply
- Experience
- 5+ yrs
- Salary
- —
- Openings
- 1
- Posted
- 3 days ago
- Work mode
- In office
- Resume
- Required to apply
Where you'll work
Sign in to tell us what does and doesn't work for you here — it sharpens every match we show you.
Job description
Role Overview
As a Senior Security Consultant based in Doha, Qatar, the incumbent will be responsible for leading application security assessments and penetration testing initiatives. This position requires a demonstrated history of at least five years in relevant security roles, focusing on identifying and mitigating vulnerabilities in various application environments.
Key Responsibilities
- Conduct both manual and automated security evaluations of web applications, mobile apps (Android and iOS), and APIs to uncover security weaknesses and advise on corrective measures.
- Manage and configure tools related to Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Software Composition Analysis (SCA), especially expertise with the Veracode Application Security Platform.
- Implement Secure Software Development Life Cycle (SDLC) and DevSecOps methodologies, embedding automated security scans within CI/CD workflows using platforms such as GitHub Enterprise and GitHub Actions.
- Perform in-depth API security assessments for protocols including REST, SOAP, OAuth 2.0, OpenID Connect, and JWT to ensure compliance with security standards.
- Apply industry-standard frameworks like OWASP Top 10, Application Security Verification Standard (ASVS), Web Security Testing Guide (WSTG), API Security Top 10, and Mobile Application Security Verification Standard (MASVS)/Mobile Security Testing Guide (MSTG), along with threat modeling and security-focused design principles.
- Utilize penetration testing tools such as Burp Suite Professional to detect, confirm vulnerabilities, and assist in remediation efforts.
- Develop comprehensive security reports with pragmatic recommendations, collaborate closely with developers, and promote ongoing security enhancements throughout the application development lifecycle.
Preferred Certifications
Certifications considered highly valuable include OSCP, OSWE, GWAPT, CSSLP, Burp Suite Certified Practitioner, and Veracode credentials. Additional credentials such as CISSP, CISM, or GSEC are advantageous.