Deloitte
Penetration Tester, Cyber Operate
- Permanent
- Riyadh, Saudi Arabia
- Experience 2 - 5 yrs
Job expiry date: 27/11/2026
Job overview
Date posted
13/10/2026
Location
Riyadh, Saudi Arabia
Salary
Undisclosed
Compensation
Comprehensive package
Experience
2 - 5 yrs
Seniority
Experienced
Qualification
Bachelors degree
Expiration date
27/11/2026
Job description
Finding weaknesses before attackers do is the point of this Penetration Tester role in Deloitte's Cyber Operate team in Riyadh. Every engagement starts with agreed scope, rules of engagement and written authorisation, and testing follows NIST SP 800-115, PTES and OWASP so live, guest-facing services stay safe. Targets vary widely. In a given week you might test web applications and APIs against the OWASP Testing Guide and ASVS, iOS and Android apps under OWASP MASTG, or internal and external networks for lateral movement and privilege escalation. Active Directory and Entra ID attack paths, Kerberos weaknesses and cloud misconfigurations in Azure, AWS and GCP are all in scope, along with Wi-Fi, physical access and authorised phishing. At senior levels, the work extends to objective-based red team exercises mapped to MITRE ATT&CK and purple team sessions with the SOC. Clear, risk-rated reports with attack narratives and practical remediation steps matter as much as the testing itself, followed by retests to confirm closure. Day-to-day tooling includes Burp Suite, Nmap, Metasploit and BloodHound, with scripting in Python, Bash or PowerShell. Expect to need 2 to 7 years of hands-on testing for real organisations, with OSCP, CREST CRT/CCT or GPEN preferred.
Required skills
Key responsibilities
- Agree scope, objectives, rules of engagement and test windows with system owners, and obtain written authorisation before any testing
- Select the right approach for each target, whether black-box, grey-box or white-box, external or internal, announced or unannounced
- Follow a defined methodology such as NIST SP 800-115, PTES and OWASP, keeping testing safe for live, guest-facing services
- Test web applications and APIs for authentication, authorisation, business logic, injection, session handling and API security flaws
- Assess iOS and Android apps and their back-ends following OWASP MASTG
- Examine internal and external networks for perimeter exposure, segmentation gaps, lateral movement and privilege escalation
- Evaluate Active Directory and Entra ID attack paths, Kerberos weaknesses, privilege misconfigurations and credential exposure
- Review Azure, AWS and GCP environments for misconfigurations, excessive permissions and exposed services
- Check corporate and guest Wi-Fi and, where authorised, physical access controls
- Run authorised phishing and pretexting exercises with the Awareness team
- Lead objective-based red team exercises that emulate realistic threat actors, mapped to MITRE ATT&CK
- Facilitate purple team sessions with the SOC to improve detection and response
- Write clear, risk-rated reports with evidence, attack narratives, remediation steps and a plain-language executive summary
- Brief technical teams and management on results and business impact
- Retest fixes, confirm closure and pass validated findings to Vulnerability Management and Risk
- Build reusable test cases, scripts and checklists to make testing faster and more consistent
Experience & skills
- Bring 2 to 7 years of total experience
- Hold a bachelor's degree in cybersecurity, computer science or a related field, or equivalent practical experience
- Demonstrate hands-on experience delivering penetration tests for real organisations beyond labs or CTFs
- Use core tools confidently, including Burp Suite, Nmap, Metasploit, BloodHound and common post-exploitation frameworks
- Script in Python, Bash or PowerShell
- Produce strong written reports in English
- Possess a recognised hands-on offensive certification such as OSCP for Mid and Senior levels, with CREST CRT/CCT or GPEN also preferred
- Understand frameworks and standards including NCA ECC, NIST SP 800-115, PTES, OWASP WSTG, ASVS and MASTG, MITRE ATT&CK and CREST methodology
- Offer red team experience with C2 frameworks such as Cobalt Strike, Sliver or Mythic (preferred)
- Show mobile application and cloud penetration testing experience (preferred)
- Apply exploit development or code review skills (preferred)
- Add experience testing hospitality, payments, smart-city or OT-adjacent environments (preferred)
- Speak Arabic (preferred)