Threat Modeling Specialist

About the Role

Hays is seeking an experienced Threat Modeling Specialist to join a large-scale cybersecurity architecture and security assurance program. This is a 12-month contract position located in Riyadh, Saudi Arabia, focusing on a highly regulated enterprise environment. The role involves identifying, analyzing, and mitigating security threats across various enterprise components.

Key Responsibilities

• Conduct threat modeling exercises for enterprise applications, cloud environments, infrastructure platforms, and system integrations.
• Identify potential attack vectors, threat actors, attack paths, and security weaknesses within complex technology environments.
• Perform attack surface analysis and threat identification activities.
• Apply industry-recognized threat modeling methodologies including STRIDE and PASTA.
• Leverage MITRE ATT&CK to assess adversarial tactics, techniques, and procedures (TTPs).
• Develop threat scenarios and evaluate business and technical risks associated with identified threats.
• Translate threat modeling findings into actionable security architecture requirements and recommendations.
• Collaborate with security architects, infrastructure teams, cloud engineers, application developers, and project stakeholders.
• Support security architecture reviews and security-by-design initiatives.
• Maintain threat model repositories, documentation, and reporting artifacts.
• Assess critical business systems and high-risk technology initiatives.
• Contribute to security baselines, architecture standards, and risk management activities.
• Support compliance with cybersecurity frameworks, regulatory requirements, and industry best practices.

Required Qualifications and Experience

• Bachelor's degree in Cybersecurity, Information Security, Computer Science, Information Technology, or a related discipline.
• 5-10 years of experience conducting threat modeling for enterprise environments.
• Hands-on expertise in STRIDE, PASTA, MITRE ATT&CK, Attack Surface Analysis, Threat Identification, Security Architecture Reviews, and Risk Assessment Methodologies.
• Experience assessing applications, APIs, cloud platforms, infrastructure, and system integrations.
• Ability to communicate technical risks to both technical and business stakeholders.
• Strong documentation and reporting skills.

Preferred Certifications and Experience

• CISSP (Certified Information Systems Security Professional).
• GCTI (GIAC Cyber Threat Intelligence).
• Practical experience with STRIDE and/or PASTA.
• Strong knowledge of the MITRE ATT&CK Framework.
• Experience within banking, financial services, government, or other highly regulated environments.
• Experience working alongside security architecture and governance teams.
• Familiarity with cloud security, application security, IAM, and cybersecurity risk management.
• Experience supporting enterprise cybersecurity transformation initiatives.

Work Type

This is a 12-month contract position.