Penetration Testing & Secure Code Review Specialist

Role Overview

This position is for a Penetration Testing & Secure Code Review Specialist to support a semi-government organization in Jeddah. The role focuses on finding security weaknesses, reviewing application source code for flaws, and recommending practical fixes that strengthen the overall security environment.

Key Duties

• Run penetration tests across web, mobile, API, network, and infrastructure environments.
• Review application source code both manually and with automated techniques, covering technologies such as Java, .NET, Python, PHP, JavaScript, and related stacks.
• Discover, verify, and rank vulnerabilities according to their business impact.
• Write detailed technical findings and executive-level summaries, including clear remediation guidance.
• Use standard security tools to perform vulnerability assessments and related checks.
• Work with development teams to correct security issues and improve code quality.
• Re-test fixes to confirm that vulnerabilities have been properly addressed.
• Carry out threat modeling and review security architecture when needed.
• Ensure applications follow secure coding practices and established security standards.
• Contribute to Secure SDLC and DevSecOps initiatives.
• Create proof-of-concept demonstrations for vulnerabilities when required.
• Stay informed about new attack methods, threats, and cybersecurity trends.
• Take part in Red Team and Purple Team activities as needed.
• Help align work with cybersecurity frameworks and regulatory requirements.

Required Background

• A bachelor’s degree in Computer Science, Cybersecurity, Information Security, or a similar discipline is required.
• Candidates must be Saudi nationals.
• At least 4 years of practical experience in penetration testing and secure code review is required.
• Strong working knowledge of OWASP Top 10, OWASP ASVS, CWE, CVSS, MITRE ATT&CK, and Secure SDLC.
• Experience testing web applications, mobile apps for Android and iOS, APIs, internal and external networks, and cloud environments.
• Ability to assess source code in one or more languages such as Java, C#, .NET, Python, PHP, JavaScript, or Go.
• Hands-on familiarity with tools such as Burp Suite Professional, OWASP ZAP, Nmap, Nessus, Metasploit, Wireshark, and SAST/DAST/SCA solutions.
• Solid understanding of authentication, authorization, cryptography, and secure development principles.
• Strong analytical ability, documentation skills, and communication skills.

Additional Information

This is a full-time onsite role based in Jeddah, Saudi Arabia, and the client is a semi-government entity.

Eligibility

Only Saudi nationals who meet the experience and technical requirements should apply.