Penetration Testing and Red Teaming Lead

This role is responsible for leading, maturing, and executing the organization's offensive security and proactive defense programs, primarily encompassing Penetration Testing, Red Teaming, Vulnerability Management, and Secure Software Development Lifecycle (S-SDLC). The successful candidate will be the subject matter expert in securing applications, infrastructure, and cloud environments, acting as a crucial bridge between security, development, and IT operations to implement a DevSecOps model.

Key Areas of Responsibility

• Program Leadership: Develop and execute the organization's penetration testing and red teaming exercises across all critical assets.
• Vulnerability Management: Own the full vulnerability lifecycle, prioritizing remediation based on business risk and impact.
• Application Security (AppSec): Define and implement secure code review (SAST/DAST) processes and integrate security into the CI/CD pipeline.
• Architecture & Design: Provide expert security assurance on new system designs, ensuring adherence to secure architecture patterns (e.g., Zero Trust).

Candidate Qualifications

• Proven experience in developing, managing, and executing a formal Penetration Testing and Red Teaming program. Extensive hands-on experience in conducting advanced, targeted penetration tests against various environments (web, mobile, cloud, API).
• Demonstrated expertise in operating and optimizing Vulnerability Management tools (e.g., Qualys, Nessus) and implementing a risk-based prioritization approach.
• Strong background in Secure Software Development Lifecycle (S-SDLC) implementation and integrating security practices into CI/CD pipelines (DevSecOps).

Experience

• Experience with managing and configuring Static/Dynamic Application Security Testing (SAST/DAST) tools.
• Experience with Threat Modeling methodologies for new applications and features.
• Deep understanding of security frameworks such as OWASP Top 10, MITRE ATT&CK, and SAMA CSF (or similar financial/regulatory frameworks).
• Knowledge of Zero Trust architecture, defense-in-depth principles, and cloud security best practices (OCI/Azure/GCP).

Skills

• DevSecOps integration for security automation and speed.
• Penetration testing expertise to validate defenses.
• Security architecture design for resilient systems.
• Threat Modeling, S-SDLC Implementation, Zero Trust, Security Standards Development.