Cybersecurity Consultant TVA

The Cybersecurity Consultant is a hands-on cybersecurity professional responsible for conducting vulnerability assessments, penetration testing activities, and security reviews across customer environments. This role works closely with customers, infrastructure teams, application owners, and security stakeholders to identify security weaknesses, validate risks, and provide practical remediation recommendations.

The role combines technical security testing, customer engagement, and cybersecurity consultancy to help organizations strengthen their security posture, reduce risk, and improve compliance with security best practices and regulatory requirements.

• Conduct vulnerability assessments and penetration tests across network, infrastructure, server, application, and cloud environments.
• Perform internal and external network penetration testing within approved scopes and rules of engagement.
• Conduct web application and API security assessments using recognized industry methodologies and frameworks.
• Perform authenticated and unauthenticated vulnerability scanning using approved commercial and open-source security tools.
• Validate vulnerabilities identified by automated tools and remove false positives before reporting.
• Perform controlled exploitation activities to confirm vulnerability impact while minimizing operational risk.
• Assess Windows, Linux, Active Directory, databases, network devices, and security infrastructure for security weaknesses.
• Evaluate vulnerabilities based on exploitability, asset criticality, technical severity, and business impact.
• Assign risk ratings using CVSS and applicable customer risk-classification methodologies.
• Prepare technical assessment reports, executive summaries, and remediation recommendations.
• Present assessment findings and risk remediation plans to technical and business stakeholders.
• Conduct remediation workshops and provide technical guidance to customer teams.
• Perform remediation validation and retesting activities.
• Maintain assessment evidence, testing records, screenshots, tool outputs, and supporting documentation.
• Support assessment planning activities, including scope definition, methodology selection, and rules of engagement.
• Ensure all testing activities comply with approved authorization requirements and security testing procedures.
• Support security consulting initiatives related to system hardening, vulnerability remediation, application security, and infrastructure security.
• Assist with security assessments aligned to recognized frameworks including NCA ECC, SAMA CSF, ISO 27001, CIS Controls, and PCI DSS.
• Contribute to continuous improvement of internal security testing methodologies, reporting templates, and knowledge repositories.
• Support presales activities by providing technical input for customer proposals, assessment scope definitions, and effort estimates.
• Perform any other cybersecurity consulting, vulnerability management, or penetration testing activities as required.

• Strong understanding of vulnerability assessment and penetration testing methodologies.
• Hands-on experience conducting network, infrastructure, web application, and API security testing.
• Strong knowledge of TCP/IP networking, routing, switching, DNS, HTTP/HTTPS, VPNs, firewalls, and enterprise network services.
• Good working knowledge of Windows, Linux, and Active Directory environments.
• Familiarity with common attack techniques including privilege escalation, credential attacks, lateral movement, and Active Directory exploitation.
• Strong understanding of OWASP Top 10, OWASP API Security Top 10, CVSS, CWE, and MITRE ATT&CK frameworks.
• Practical experience using security assessment tools such as Burp Suite, Nmap, Nessus, Qualys, Rapid7, Metasploit, Wireshark, OWASP ZAP, and Kali Linux.
• Ability to manually validate vulnerabilities and distinguish genuine findings from false positives.
• Understanding of common security technologies including WAF, IDS/IPS, NAC, EDR, SIEM, and secure remote access solutions.
• Basic scripting capabilities using Python, Power Shell, Bash, or similar languages.
• Strong analytical and problem-solving skills with the ability to think from an attacker's perspective.
• Strong report writing, evidence documentation, and presentation skills.
• Ability to communicate technical vulnerabilities and risks to both technical and business stakeholders.
• Ability to manage multiple customer engagements and work independently while maintaining high-quality…