VAPT Consultant

About the Role

Women First Jobs is seeking an experienced L3 VAPT Consultant to lead and execute advanced Vulnerability Assessment and Penetration Testing engagements. This full-time position is based in Riyadh, Saudi Arabia, and requires strong hands-on technical expertise to independently manage complex security assessments and provide technical leadership. The role involves direct engagement with customers for technical discussions and remediation guidance.

Key Responsibilities

• Lead end-to-end Vulnerability Assessment and Penetration Testing (VAPT) engagements.
• Perform advanced penetration testing across web applications, mobile applications, APIs, network infrastructure, internal and external environments, Active Directory, cloud environments, and containers.
• Conduct manual testing beyond automated vulnerability scanning to identify complex security weaknesses.
• Perform exploitation and validation of vulnerabilities to determine actual business/security impact.
• Conduct PT/VA, configuration reviews, security assessments, and red-team style testing as required.
• Analyze vulnerabilities using industry-standard methodologies such as OWASP, PTES, OSSTMM, NIST, and CVSS.
• Develop detailed technical findings including vulnerability description, business/security impact, evidence, proof of concept, risk rating, root cause, and remediation recommendations.
• Prepare high-quality technical and executive-level VAPT reports.
• Conduct vulnerability retesting and validate remediation implemented by customers.
• Provide technical guidance to L1/L2 consultants and review their findings and reports.
• Act as the technical escalation point for complex VAPT issues.
• Participate in customer discussions, technical workshops, remediation meetings, and closure calls.
• Support pre-sales activities including technical presentations, scope discussions, effort estimation, RFP/RFQ responses, and solution design.
• Assist in developing VAPT methodologies, checklists, automation scripts, and reusable testing frameworks.
• Stay updated on emerging vulnerabilities, exploits, attack techniques, and security trends.
• Maintain appropriate documentation of testing activities, evidence, and customer deliverables.

Required Technical Skills

• Strong hands-on experience in VAPT and penetration testing.
• Excellent knowledge of OWASP Top 10, OWASP API Security, web application security, mobile application security, network security, Active Directory security, API security, and cloud security.
• Strong understanding of TCP/IP, DNS, HTTP/HTTPS, SSL/TLS, authentication, and authorization mechanisms.
• Practical experience with tools such as Burp Suite, Nmap, Nessus/Qualys, Metasploit, Wireshark, Kali Linux, SQLMap, Nikto, Gobuster/Dirsearch, BloodHound, PowerShell, and scripting tools.
• Ability to perform manual exploitation and vulnerability validation rather than relying solely on automated tools.
• Good understanding of CVE/CVSS, exploitability, and vulnerability risk assessment.
• Strong report-writing and documentation skills.

Experience and Qualifications

• Proven experience (5-10 years) independently managing complex VAPT engagements.
• Experience working with enterprise customers and conducting customer-facing technical discussions.
• Experience mentoring junior/mid-level security consultants.
• Experience in consulting, managed security services, or cybersecurity service providers is preferred.

Behavioral and Professional Skills

• Strong analytical and problem-solving skills.
• Ability to work independently and manage multiple engagements simultaneously.
• Strong customer-facing and communication skills.
• Ability to explain complex technical vulnerabilities to both technical and non-technical stakeholders.
• Strong ownership of deliverables, timelines, and customer commitments.
• Willingness to travel to customer locations when required.

Application Information

This is a full-time position based in Riyadh, Saudi Arabia. Salary information will be disclosed during the interview process.