Consultant - Cybersecurity, Penetration Testing

ABOUT THE ROLE
The Consultant role in the Cybersecurity department is essential for identifying and assessing cybersecurity weaknesses through the planning and execution of authorized penetration testing engagements across various technology environments, including applications and infrastructure. This position provides technical analysis and practical remediation recommendations, validates corrective actions, and drives continuous improvement of penetration testing practices to enhance the organization's cybersecurity posture.

KEY ACCOUNTABILITIES & ACTIVITIES

• Engagement Scoping & Planning

  • Define testing objectives, scope, prerequisites, and deliverables with asset owners and relevant cybersecurity stakeholders.
  • Prepare engagement plans and rules of engagement covering authorization, permitted techniques, testing windows, and escalation arrangements.
  • Assess testing risks and coordinate access and operational safeguards before commencing approved activities.

• Application & API Penetration Testing

  • Perform authorized penetration testing of web applications, mobile applications, and APIs within the agreed scope.
  • Assess authentication, authorization, session management, input handling, and business logic controls using manual and automated techniques.
  • Validate identified weaknesses and document reproducible evidence and potential business impacts.

• Infrastructure & Platform Penetration Testing

  • Assess in-scope internal and external networks, systems, and cloud environments for exploitable weaknesses and configuration gaps.
  • Evaluate attack paths, privilege boundaries, and exposure of sensitive services through controlled testing within approved limits.
  • Coordinate with technical owners to manage testing dependencies and promptly escalate unexpected operational impacts.

• Vulnerability Validation & Risk Analysis

  • Analyze testing results, remove false positives, and assess the exploitability and impact of confirmed findings.
  • Prioritize findings using the approved risk assessment approach, considering asset criticality, exposure, and compensating controls.
  • Identify related weaknesses and attack chains to explain potential impacts on critical services and information assets.

• Technical Reporting & Remediation Advisory

  • Produce penetration testing reports covering scope, approach, findings, supporting evidence, risk ratings, and remediation recommendations.
  • Communicate technical findings and business implications to asset owners and relevant stakeholders.
  • Advise technical teams on practical corrective measures and clarify findings throughout remediation.

• Remediation Validation & Closure

  • Conduct retesting to verify corrective actions and assess whether identified weaknesses have been adequately addressed.
  • Maintain accurate finding status and supporting evidence, and escalate overdue or unresolved issues through established channels.
  • Document residual weaknesses and provide technical input to formal closure or risk acceptance decisions by authorized owners.

• Testing Methods, Tools & Quality

  • Maintain and improve testing procedures, checklists, and reusable scripts in line with approved methodologies.
  • Evaluate testing tools and techniques in controlled environments and recommend improvements to coverage and efficiency.
  • Review technical evidence and reports, share specialist knowledge, and provide guidance to colleagues to support consistent testing quality.

• Stakeholder Coordination & Technical Research

  • Coordinate engagement schedules, dependencies, and deliverables with business stakeholders, technology teams, and external testing providers.
  • Research emerging vulnerabilities and attack techniques relevant to the organization’s technology landscape and incorporate applicable scenarios into approved testing.
  • Maintain engagement records and handle credentials, test data, and evidence securely throughout testing and closure.

• Policies, Processes & Procedures

  • Follow all relevant departmental policies, processes, standard operating procedures, and instructions to ensure work is carried out in a controlled and consistent manner.
  • Comply with all relevant safety, quality, and environmental management policies, procedures, and controls to ensure a healthy and safe work environment.

• Information Security

  • Comply with all relevant information security practices and standards to ensure data integrity and confidentiality.

JOB SPECIFICATIONS

• Academic and Professional Qualifications

  • Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, Computer Engineering, or a related field.
  • Relevant professional certifications in penetration testing or offensive security are considered an advantage.

• Years and Nature of Experience

  • 4–6 years of experience in penetration testing, vulnerability assessment, or offensive security, including hands-on testing, technical reporting, and remediation validation.