Our shared values guide the way we behave to make a positive, enduring impact:

During your tenure as a Consultant – Manager, you will demonstrate and develop your capabilities in the following areas.

Plan and scope engagements

·       Agree scope, objectives, rules of engagement and test windows with system owners, and obtain written authorisation before any testing

·       Choose the right approach for each target: black-box, grey-box or white-box, external or internal, announced or unannounced

·       Follow a defined methodology (NIST SP 800-115, PTES, OWASP) and keep testing safe for live, guest-facing services

Conduct penetration tests

·       Web applications and APIs: test authentication, authorisation, business logic, injection, session handling and API security, following the OWASP Testing Guide and ASVS

·       Mobile applications: test iOS and Android apps and their back-ends following OWASP MASTG

·       Internal and external networks: test perimeter exposure, internal segmentation, lateral movement and privilege escalation

·       Active Directory and identity: test AD and Entra ID attack paths, Kerberos weaknesses, privilege misconfigurations and credential exposure

·       Cloud environments: test Azure, AWS and GCP for misconfigurations, excessive permissions and exposed services

·       Wireless and physical: test corporate and guest Wi-Fi and, where authorised, physical access controls

·       Social engineering: run authorised phishing and pretexting exercises with the Awareness team

Run red and purple team exercises (Senior)

·       Plan and lead objective-based red team exercises that emulate realistic threat actors, mapped to MITRE ATT&CK

·       Run purple team sessions with the SOC to test and improve detection and response

Report and drive fixes

·       Write clear, risk-rated reports with evidence, attack narratives and practical remediation steps, plus a short executive summary in plain language

·       Brief technical teams and management on results, and explain business impact without exaggeration

·       Retest fixes, confirm closure, and pass validated findings to Vulnerability Management and Risk for tracking

·       Build reusable test cases, scripts and checklists to make testing faster and more consistent

Leadership Capabilities:

Builds own understanding of our purpose and values; explores opportunities for impact.  

Demonstrates strong commitment to personal learning and development; acts as a brand ambassador to help attract top talent.  

Understands expectations and demonstrates personal accountability for keeping performance on track.  

Actively focuses on developing effective communication and relationship-building skills. 

Understands how their daily work contributes to the priorities of the team and the business. 

Qualifications:

·       Years of experience: 2-7 total years

·       Bachelor's in cybersecurity, computer science or a related field, or equivalent practical experience

·       Hands-on experience delivering penetration tests for real organisations, not only labs or CTFs

·       Strong with core tools: Burp Suite, Nmap, Metasploit, BloodHound and common post-exploitation frameworks

·       Scripting in Python, Bash or PowerShell

·       Strong report writing in English

·       A recognised hands-on offensive certification (e.g. OSCP) for Mid and Senior levels

·       Red team experience with C2 frameworks (e.g. Cobalt Strike, Sliver, Mythic) is preferred.

·       Mobile application and cloud penetration testing experience is preferred.

·       Exploit development or code review skills is preferred.

·       Experience testing hospitality, payments, smart-city or OT-adjacent environments is preferred.

·       Arabic language is preferred.

·       At least one preferred: OSCP, CREST CRT/CCT, GPEN. Also valued: OSEP, OSWE, CRTO, GWAPT, eCPPT/eWPT, PNPT. CEH is accepted at Junior level only.

Desired Candidate Profile