Security Consultant – AppSec & Penetration Testing.

Role: Senior Security Consultant Job Type: FTE - Onsite Location : Doha, Qatar Experience: Minimum 5 years of relevant experience Key Responsibilities & Required Skills • Perform manual and automated application security assessments and penetration testing of web applications, APIs, Android and iOS applications to identify vulnerabilities and recommend remediation. • Hands-on experience with SAST, DAST and Software Composition Analysis (SCA), including administration and configuration of the Veracode Application Security Platform. • Implement Secure SDLC and DevSecOps practices, integrating automated security testing into CI/CD pipelines using GitHub Enterprise, GitHub Actions or equivalent technologies. • Conduct API security testing covering REST, SOAP, OAuth 2.0, OpenID Connect and JWT, ensuring applications and APIs adhere to security best practices. • Apply OWASP methodologies, including OWASP Top 10, ASVS, WSTG, API Security Top 10 and MASVS/MSTG, along with secure coding practices, application threat modelling and security-by-design principles. • Demonstrate hands-on proficiency with Burp Suite Professional or equivalent penetration testing tools, including vulnerability identification, validation and remediation support. • Prepare detailed security assessment reports, provide actionable remediation recommendations, collaborate with development teams, and support continuous security improvements throughout the application lifecycle. Preferred Certifications: OSCP, OSWE, GWAPT, CSSLP, Burp Suite Certified Practitioner, Veracode certification or equivalent. CISSP, CISM or GSEC are additional advantages. Show more Show less

Minimum 5 years of relevant experience

Perform manual and automated application security assessments and penetration testing of web applications, APIs, Android and iOS applications to identify vulnerabilities and recommend remediation. Hands-on experience with SAST, DAST and Software Composition Analysis (SCA), including administration and configuration of the Veracode Application Security Platform. Implement Secure SDLC and DevSecOps practices, integrating automated security testing into CI/CD pipelines using GitHub Enterprise, GitHub Actions or equivalent technologies. Conduct API security testing covering REST, SOAP, OAuth 2.0, OpenID Connect and JWT, ensuring applications and APIs adhere to security best practices. Apply OWASP methodologies, including OWASP Top 10, ASVS, WSTG, API Security Top 10 and MASVS/MSTG, along with secure coding practices, application threat modelling and security-by-design principles. Demonstrate hands-on proficiency with Burp Suite Professional or equivalent penetration testing tools, including vulnerability identification, validation and remediation support. Prepare detailed security assessment reports, provide actionable remediation recommendations, collaborate with development teams, and support continuous security improvements throughout the application lifecycle.