Qureos Mentor

Protiviti Middle East Member Firm

<div>
 
 Experience &ndash; 2 to 6 Years
 
 
 Department &ndash; Security &amp; Privacy Services
 
 
 Position Type &ndash; Full time &ndash; Permanent
 
 
 
 
 
 
 
 Role Summary
 
 
 
 Looking for experienced consultants to join the S&amp;P team at Protiviti. The role involves executing and managing various client engagements. Though based in UAE, resources may travel across client locations in the Middle East.
 
 
 The applicant will be responsible for assessing the security posture of client systems, platforms, and processes to improve the confidentiality, integrity, and availability of information systems in line with client's business objectives, regulatory requirements, and strategic goals.
 
 
 
 
 
 
 
 Responsibilities
 
 
 <ul>
 <li>
 Provide innovation within the Vulnerability and Penetration Testing (VAPT) program regarding both process and technology.
 </li>
 <li>
 Serve as a Subject Matter Expert (SME) for the Attack &amp; Pen function.
 </li>
 <li>
 Perform authorized attack surface reviews, penetration tests, and red team assessments.
 </li>
 <li>
 Provide assessment reports that are understandable by the target audience and include practical recommendations based on sound risk management principles.
 </li>
 <li>
 Update standards and procedures to continually improve security posture.
 </li>
 <li>
 Assess the sufficiency of policies, standards, and procedures relative to security best practices.
 </li>
 <li>
 Contribute to security-related information repositories and other business development activities.
 </li>
 <li>
 Mentor junior team members and provide consultation to peer groups.
 </li>
 </ul>
 
 
 
 
 
 
 Background Requirements
 
 
 <ul>
 <li>
 Bachelor&rsquo;s Degree in Computer Science or substantial equivalent.
 </li>
 <li>
 2 to 6 years of professional experience in information security with a focus on technical assessments.
 </li>
 <li>
 Knowledge of pen testing concepts and best practices.
 </li>
 <li>
 Experience with common Pentesting tools such as Nessus, Appscan, Burp Suite, Nipper, Exploit Pack, etc.
 </li>
 <li>
 Proficiency with other common attack tools and frameworks such as Wireshark, Kali, Metasploit, etc.
 </li>
 <li>
 Ability to validate identified vulnerabilities accurately.
 </li>
 <li>
 Understanding of common application platforms and technologies to evaluate complex application assessments using manual techniques and tools such as proxies and browser plugins.
 </li>
 <li>
 In-depth understanding of OWASP, CVE, general security controls, and topics like the latest application and operating system exploits.
 </li>
 <li>
 Knowledge of scripting and programming languages like Python, shell script, etc.
 </li>
 <li>
 Preferable certifications: GIAC GPEN, GWAPT, CREST, OSCP, OSWP, OSCE.
 </li>
 </ul>
 
 
 Personal Skills
 
 
 <ul>
 <li>
 Ability to maintain critical thinking and composure under pressure.
 </li>
 <li>
 Strong written and oral communication skills in English, able to convey complex concepts to a business audience.
 </li>
 <li>
 Ability to be productive and focused with minimal supervision.
 </li>
 <li>
 Understands VAPT in the context of risk management and organizational priorities.
 </li>
 </ul>
 
 
</div>

VAPT-Consultant

<div>
 
 Role and responsibilities
 
 <ul>
 <li>
 Conduct comprehensive cybersecurity maturity assessments across organizational systems and processes, with a focus on aligning with the Capability Maturity Model Integration (CMMI).
 </li>
 <li>
 Perform evaluations that measure the maturity of existing cybersecurity practices, identifying areas of strength and opportunities for improvement.
 </li>
 <li>
 Experience in compliance with relevant regulations, standards, and best practices, including but not limited to:
 </li>
 <li>
 All KSA National Cybersecurity Authority (NCA) regulations
 </li>
 <li>
 ISO 27001 (Information Security Management)
 </li>
 <li>
 ISO 27017 (Cloud Security)
 </li>
 <li>
 Provide detailed, actionable recommendations to address identified gaps during assessments, focusing on improving cybersecurity practices.
 </li>
 <li>
 Develop a clear, strategic roadmap outlining short-term, mid-term, and long-term actions needed to close gaps and achieve maturity goals.
 </li>
 <li>
 Prepare comprehensive reports on assessment findings, compliance status, and risk mitigation strategies, presenting them to senior leadership and relevant stakeholders.
 </li>
 <li>
 Serve as a subject matter expert on cybersecurity, advising organizations on compliance and best practices.
 </li>
 <li>
 Assist members of the Governance, Risk, and Compliance team to answer technical inquiries from auditors and clients.
 </li>
 <li>
 Recommend emerging security technologies/tools to address current and future threats.
 </li>
 <li>
 Interact and handle vendors, outsourcers, and contractors regarding security products and services.
 </li>
 <li>
 Conduct performance and efficacy testing to stress the limitations of security solutions while ensuring business innovation and day-to-day processes are not negatively impacted.
 </li>
 <li>
 Serve as a trusted advisor, collaborating closely with clients to understand their unique challenges and providing expert guidance on cybersecurity and risk management.
 </li>
 <li>
 Manage end-to-end delivery of client engagements, from scoping through execution.
 </li>
 <li>
 Assist clients in developing / enhancing their cybersecurity strategies and multi-year implementation roadmaps, in alignment with their risk landscape.
 </li>
 <li>
 Provide support in the design and implementation of cybersecurity governance frameworks and policies.
 </li>
 <li>
 Conduct comprehensive risk assessments to identify and prioritize cyber risks and develop risk management strategies to mitigate risks effectively.
 </li>
 </ul>
 
 
 
 
 
 Understanding and experience is preferable but not mandatory.
 
 
 <ul>
 <li>
 Understanding of Security Configuration Review: Conduct in-depth security configuration reviews for firewalls, routers, switches, servers, and other security devices.
 </li>
 <li>
 Review and assess firewall rulesets, identifying redundant, outdated, or overly permissive rules, and recommend necessary optimizations.
 </li>
 <li>
 Ensure that firewall configurations follow the principle of least privilege and are aligned with security best practices.
 </li>
 <li>
 Understanding of File Intergity Monitoring (FIM): Experience in deploying FIM solutions and monitoring changes in critical system files, directories, and configurations.
 </li>
 <li>
 Experience in continuous monitoring of file changes and generating alerts for unauthorized modifications.
 </li>
 <li>
 Analyze and report on FIM alerts, working with clients to remediate suspicious activity.
 </li>
 <li>
 Provide recommendations for improving FIM configurations based on threat landscape and compliance requirements.
 </li>
 <li>
 Integrate FIM with security operations tools such as SIEM to enhance visibility and threat detection.
 </li>
 <li>
 Antimalware: Assess client environments to recommend the best-fit antivirus and anti-malware solutions.
 </li>
 <li>
 Implement and configure antivirus/anti-malware software across endpoints, servers, and network devices.
 </li>
 <li>
 Monitor and maintain antivirus solutions, ensuring timely signature updates, patches, and upgrades.
 </li>
 <li>
 Integrate antivirus systems with SIEM and other security tools to enhance threat detection and response capabilities.
 </li>
 <li>
 Develop strategies for malware incident response, including investigation, containment, and remediation.
 </li>
 <li>
 Understanding of Web Proxy: Deploy, configure, and maintain web proxy solutions to filter and monitor client internet traffic, ensuring compliance with internal and regulatory requirements.
 </li>
 <li>
 Set up content filtering policies, block malicious websites, and protect against web-based threats like malware, ransomware, and phishing.
 </li>
 <li>
 Monitor and analyze web traffic patterns to identify and respond to suspicious activities and security incidents.
 </li>
 <li>
 Email Gateway: Configure, deploy, and manage secure email gateways (SEG) to prevent email-borne threats such as phishing, malware, and spam.
 </li>
 <li>
 To ensure effective filtering of incoming and outgoing email traffic in compliance with cybersecurity best practices and client-specific security policies.
 </li>
 <li>
 Design and deploy DLP policies and controls to prevent unauthorized data access, transfer, and leakage.
 </li>
 <li>
 Hands-on experience in configuring and managing data classification tools, including but not limited to:
 </li>
 <li>
 Develop and deliver training sessions to ensure widespread understanding of data handling policies and the use of classification and DLP tools.
 </li>
 <li>
 Network Architecture Review: Analyze, review, and develop network architecture designs based on Defense-in-Depth (DiD) principles.
 </li>
 <li>
 Experience in the implementation of multi-layered security protections across all network systems, maintaining robust safeguards against potential cybersecurity threats.
 </li>
 <li>
 Assess the effectiveness of existing network architectures and recommend enhancements based on evolving threats, emerging technologies, and the organization&rsquo;s security strategy.
 </li>
 <li>
 Experience in network security design that follows industry best practices, such as Zero Trust principles, and aligns with relevant standards and regulations (e.g., ISO 27001, NIST). Provide expert guidance on secure network configuration, including the selection and deployment of appropriate technologies to defend against internal and external threats.
 </li>
 <li>
 Zero Trust Architecture: Lead the design and implementation of Zero Trust security architectures for clients, ensuring alignment with business needs, security standards, and regulatory requirements (NIST 800-207, Zero Trust Maturity Model).
 </li>
 <li>
 Develop comprehensive Zero Trust strategies tailored to the specific needs of clients, including roadmaps for adoption, risk assessments, and key milestones for transitioning from legacy architectures.
 </li>
 <li>
 Cyber Security Architecture: Lead the design, development, and implementation of a cybersecurity architecture based on the SABSA framework, ensuring alignment with business strategy and goals.
 </li>
 </ul>
 
 
 
 
 
 Essential Skills
 
 
 <ul>
 <li>
 Drive high-quality work products within expected timeframes and on budget.
 </li>
 <li>
 Demonstrate deep technical capabilities and professional knowledge.
 </li>
 <li>
 Stay abreast of current business and industry trends relevant to the client's business.
 </li>
 <li>
 Develop and maintain long-term relationships and networks with clients and internal stakeholders of Protiviti
 </li>
 <li>
 Consistently deliver quality client services and manage expectations of client service delivery.
 </li>
 <li>
 Hands-on technology administration is not required, but sufficient familiarity to participate in technical discussions is critical.
 </li>
 <li>
 Working knowledge of general IT and business processes and familiarity with organizational technology landscapes.
 </li>
 <li>
 Comfortable taking a client-facing role and can effectively convey technical concepts to non-technical stakeholders.
 </li>
 </ul>
 
 
 Qualifications
 
 
 <ul>
 <li>
 Bachelor&rsquo;s degree in computer science, Information Security, or a related field (master&rsquo;s degree preferred).
 </li>
 <li>
 CISSP/CISM/ CRISC/ CCSP/ SABSA/CISSA are preferred. Any 2 certifications are mandatory.
 </li>
 </ul>
 
 
 Experience:
 
 
 <ul>
 <li>
 4+ years of experience in cyber security or related roles.
 </li>
 <li>
 Extensive experience working in the Kingdom of Saudi Arabia (KSA) and other Gulf Cooperation Council (GCC) countries.
 </li>
 </ul>
 
 
</div>

Senior Consultant Cybersecurity-Arabic Speaker

Join Protiviti Middle East Member Firm and explore 2   exciting career opportunities. They're hiring for various roles with options for remote or on-site work. Apply today and become part of their innovative team.

Protiviti Middle East Member Firm

About Company

VAPT-Consultant

Senior Consultant Cybersecurity-Arabic Speaker