Summary
Elm is seeking a Cybersecurity Penetration Testing Consultant in Riyadh, Saudi Arabia. The role plans and conducts authorized penetration tests across applications, infrastructure, networks, and cloud environments, then analyzes and reports confirmed findings with practical remediation advice. Responsibilities also include retesting corrective actions, maintaining testing methods and records, and coordinating with stakeholders. Applicants need a relevant bachelor’s degree and 4–6 years of experience in penetration testing, vulnerability assessment, or offensive security; relevant professional certifications are an advantage.
The posting
As published on elm.sa. Pulled from the employer's site and shown as they wrote it.
Job Description
OVERVIEW
Job Title
Consultant
Job Code
733155
Grade
I3
Group
Legal, Risk & Governance
Division
Technology
Department
Cybersecurity
Unit
PT&VA
ROLE PURPOSE
The aim is to state the overall significance of the job from the organization’s perspective.
The role exists to support the identification and assessment of cybersecurity weaknesses through the planning and execution of authorized penetration testing engagements across applications, infrastructure, and other agreed technology environments. The role provides technical analysis and practical remediation recommendations, validates corrective actions, and contributes to the continuous improvement of penetration testing practices to strengthen the organization’s cybersecurity posture.
KEY ACCOUNTABILITIES & ACTIVITIES
This section describes the principal outputs required from the job.
Key Accountabilities
Key Activities
- Engagement Scoping & Planning
- Define testing objectives, scope, prerequisites, and deliverables with asset owners and relevant cybersecurity stakeholders.
- Prepare engagement plans and rules of engagement covering authorization, permitted techniques, testing windows, and escalation arrangements.
- Assess testing risks and coordinate access and operational safeguards before commencing approved activities.
- Application & API Penetration Testing
- Perform authorized penetration testing of web applications, mobile applications, and APIs within the agreed scope.
- Assess authentication, authorization, session management, input handling, and business logic controls using manual and automated techniques.
- Validate identified weaknesses and document reproducible evidence and potential business impacts.
- Infrastructure & Platform Penetration Testing
- Assess in-scope internal and external networks, systems, and cloud environments for exploitable weaknesses and configuration gaps.
- Evaluate attack paths, privilege boundaries, and exposure of sensitive services through controlled testing within approved limits.
- Coordinate with technical owners to manage testing dependencies and promptly escalate unexpected operational impacts.
- Vulnerability Validation & Risk Analysis
- Analyze testing results, remove false positives, and assess the exploitability and impact of confirmed findings.
- Prioritize findings using the approved risk assessment approach, considering asset criticality, exposure, and compensating controls.
- Identify related weaknesses and attack chains to explain potential impacts on critical services and information assets.
- Technical Reporting & Remediation Advisory
- Produce penetration testing reports covering scope, approach, findings, supporting evidence, risk ratings, and remediation recommendations.
- Communicate technical findings and business implications to asset owners and relevant stakeholders.
- Advise technical teams on practical corrective measures and clarify findings throughout remediation.
- Remediation Validation & Closure
- Conduct retesting to verify corrective actions and assess whether identified weaknesses have been adequately addressed.
- Maintain accurate finding status and supporting evidence, and escalate overdue or unresolved issues through established channels.
- Document residual weaknesses and provide technical input to formal closure or risk acceptance decisions by authorized owners.
- Testing Methods, Tools & Quality
- Maintain and improve testing procedures, checklists, and reusable scripts in line with approved methodologies.
- Evaluate testing tools and techniques in controlled environments and recommend improvements to coverage and efficiency.
- Review technical evidence and reports, share specialist knowledge, and provide guidance to colleagues to support consistent testing quality.
- Stakeholder Coordination & Technical Research
- Coordinate engagement schedules, dependencies, and deliverables with business stakeholders, technology teams, and external testing providers.
- Research emerging vulnerabilities and attack techniques relevant to the organization’s technology landscape and incorporate applicable scenarios into approved testing.
- Maintain engagement records and handle credentials, test data, and evidence securely throughout testing and closure.
- Policies, Processes & Procedures
- Follow all relevant departmental policies, processes, standard operating procedures, and instructions so that work is carried out in a controlled and consistent manner.
- Comply with all relevant safety, quality, and environmental management policies, procedures, and controls to ensure a healthy and safe work environment.
- Information Security
- Comply with all relevant information security practices and standards to ensure data integrity and confidentiality.
JOB SPECIFICATIONS
Academic and professional qualifications
- Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, Computer Engineering, or a related field.
- Relevant professional certifications in penetration testing or offensive security are considered an advantage.
Years and Nature of Experience
- 4–6 years of experience in penetration testing, vulnerability assessment, or offensive security, including hands-on testing, technical reporting, and remediation validation