Senior Security Consultant

Position:
Senior Security Consultant

7–9+ years’ experience

Full-time onsite

Initial 1 year

Location:

Muscat

The Senior Security Consultant will conduct penetration testing and security assessments for business projects and change requests deployed in pre-production and production environments. The consultant will assess applications, APIs, infrastructure, networks, containers and Kubernetes environments; identify vulnerabilities and security risks; recommend remediation; validate corrective actions; and support compliance with banking security standards and regulatory requirements.

• Perform web, mobile, API, network, container and Kubernetes penetration testing.
• Conduct Istio service mesh security assessments.
• Review operating systems, databases, firewalls and network-device configurations.
• Assess security architecture, configurations, vulnerabilities and associated risks.
• Conduct threat modelling, security assessments and risk workshops.
• Coordinate internal and external penetration-testing vendors, including test planning, access coordination, findings validation, remediation tracking and retesting.
• Support security tool proof-of-concept (POC) activities and evaluate their effectiveness.
• Prepare technical assessment reports, executive summaries, risk ratings and remediation recommendations.
• Engage with application development, infrastructure, cloud and Information Security teams.
• Track remediation activities and validate closure of identified security findings.

Grey-box penetration testing; OWASP Top 10; SQL injection, XSS, CSRF, SSRF, IDOR, authentication and session-management weaknesses, business logic flaws

Android and iOS penetration testing; secure storage and communication; certificate pinning; reverse engineering; root/jailbreak detection; OWASP Mobile Top 10

API Gateway testing, JWT, authentication and authorisation, rate limiting, mTLS, BOLA, excessive data exposure and business logic bypass

Cluster, worker-node, control-plane, namespace and workload assessments; RBAC, privilege escalation, container escape, image security and hardening

mTLS, authentication and authorisation policies, ingress/egress gateways, service-to-service security and observability

Internal/external network attacks, firewalls, load balancers, exposed services, ingress points, cloud workloads and network devices

Linux, Windows, database servers, middleware, firewalls, ACLs, VPNs, IDS/IPS, network segmentation, logging and administrative access

Threat modelling, vulnerability validation, risk rating, remediation recommendations, risk workshops and reporting

Scoping, test planning, access coordination, findings validation, remediation tracking, retesting and reporting

• Overall experience: 7–9+ years in cybersecurity, penetration testing and security assessments.
• Proven experience in Banking and Financial Services (BFSI), digital banking, mobile banking and payment systems.
• Exposure to SWIFT, RTGS, PCI DSS, API security assessments and regulatory compliance reviews.
• Hands‑on experience with banking applications, payment platforms, digital banking systems and their business logic.
• Experience in internal and external penetration testing, security reporting, risk workshops and POCs.

Graduate with following industry certifications are highly preferred:

• OSCP — Offensive Security Certified Professional
• OSEP — Offensive Security Experienced Penetration Tester
• OSWE — Offensive Security Web Expert
• CREST certifications
• CISSP — Certified Information Systems Security Professional
• CISM — Certified Information Security Manager
• CCSP — Certified Cloud Security Professional
• CCSK — Certificate of Cloud Security Knowledge
• GWAPT — GIAC Web Application Penetration Tester
• GPEN — GIAC Penetration Tester
• CKS — Certified Kubernetes Security Specialist
• Equivalent relevant industry certifications