Job description

Security checks that slow every release quickly get ignored, so this Riyadh role in Deloitte's Cyber Operate team builds application security into the pipeline in a way developers can live with. The secure SDLC, secure coding standards and application security requirements are defined in line with NCA ECC, OWASP ASVS and NIST SSDF. In-house and vendor-built applications get clear security requirements, acceptance criteria and contract clauses, and every application in the inventory carries a risk rating. SAST, DAST, SCA and secrets scanning are implemented and tuned in CI/CD using tools such as Checkmarx, Fortify, Veracode, SonarQube, Snyk and Burp Suite. Findings are triaged so developers get clear, fix-ready guidance rather than noise. Web, mobile and API applications are assessed in depth, including manual testing of authentication, authorisation and business logic, alongside secure code reviews and threat modelling. Container, infrastructure-as-code and cloud-native deployments are reviewed with DevOps teams, and third-party and SaaS applications are checked before adoption. Vulnerabilities are tracked to closure, risk posture is reported to management, and developers are trained on OWASP Top 10 and API Security Top 10 through a security champions network. Four to eight or more years of experience with a coding background in Java, C#/.NET, JavaScript/TypeScript or Python is required, with CSSLP, GWEB or OSWE and Arabic preferred.