Senior Consultant Manager, Cyber Operate

Our shared values guide the way we behave to make a positive, enduring impact: During your tenure as a Senior Consultant – Manager, you will demonstrate and develop your capabilities in the following areas. Set the secure development standard · Define the secure SDLC, secure coding standards and application security requirements, aligned with NCA ECC, OWASP ASVS and NIST SSDF · Set security requirements and acceptance criteria for in-house and vendor-built applications, including contract clauses and release checks · Build and maintain the application inventory, with a risk rating for each application Embed security in the pipeline · Implement and tune SAST, DAST, SCA and secrets scanning in CI/CD pipelines (e.g. Checkmarx, Fortify, Veracode, SonarQube, Snyk, Burp Suite) · Triage tool findings, remove noise, and give developers clear, fix-ready guidance so security doesn't slow releases · Review container, infrastructure-as-code and cloud-native deployments with DevOps teams Assess applications in depth · Run application security assessments of web, mobile and API applications, including manual testing of authentication, authorization and business logic · Perform secure code reviews of high-risk features and components · Lead threat modelling for new applications and major changes, working with architects and development teams · Review third-party and SaaS applications before they are adopted Drive fixes and build skills · Track application vulnerabilities to closure with development teams and vendors; verify fixes before release · Report application risk posture and trends to management · Train developers on secure coding, OWASP Top 10 and API Security Top 10, and build a network of security champions in development teams Leadership Capabilities: Builds own understanding of our purpose and values; explores opportunities for impact. Demonstrates strong commitment to personal learning and development; acts as a brand ambassador to help attract top talent. Understands expectations and demonstrates personal accountability for keeping performance on track. Actively focuses on developing effective communication and relationship-building skills. Understands how their daily work contributes to the priorities of the team and the business.

Experience

4-8+ total years Bachelor's in computer science, software engineering or a related field Software development background in at least one language (e.g. Java, C#/.NET, JavaScript/TypeScript, Python), with the ability to read and review code Hands-on experience with SAST, DAST and SCA tools in real development environments Strong knowledge of OWASP Top 10, API Security Top 10 and ASVS Experience with CI/CD pipelines and DevSecOps practices Mobile application security experience (OWASP MASVS/MASTG) is preferred. Cloud-native and container security (Kubernetes, Docker, infrastructure-as-code) is preferred. Experience with payment or customer-facing platforms (PCI DSS awareness) is preferred. Experience running a security champions programme is preferred. Arabic Language is preferred. At least one preferred: CSSLP, GWEB, OSWE. Also valued: GWAPT, CASE, eWPT, Burp Suite Certified Practitioner.