Leadership & Governance

• Lead, coordinate, and mentor the team of security assessors and auditors, and prioritize their workload across multiple concurrent engagements.
• Establish and maintain the security audit governance framework: checklists, assessment methodologies, scoping rules, review procedures, approval workflows, evidence requirements, and reporting standards.
• Review and approve audit scopes, evaluation criteria, and assessment plans.
• Ensure consistency and quality across all audit and assessment deliverables.
• Support continuous improvement of the team’s methodologies, tooling, and processes.

Vulnerability Assessment & Penetration Testing

• Plan, coordinate, and oversee penetration tests and vulnerability assessments of web applications, mobile applications (Android/iOS), APIs, and infrastructure.
• Perform architectural analysis and security design reviews to identify weaknesses and risks early.
• Review technical findings for accuracy, reproducibility, and correct risk rating before they are communicated to stakeholders.
• Hands-on involvement in testing where needed, especially for complex or high-risk targets.

Security Control Audits

• Plan and supervise audits of security controls across infrastructure, applications, and processes (e.g., access control, network security, patch and vulnerability management, logging and monitoring, change management).
• Assess the design and operating effectiveness of controls against internal policies and standards such as ISO/IEC 27001, NIST, CIS Benchmarks, and applicable regulatory requirements.
• Identify compliance gaps, control weaknesses, and recurring non-conformities, and recommend improvements.
• Define evidence requirements and ensure audit evidence is properly collected, documented, and retained.

Reporting, Remediation & Follow-up

• Prepare, review, and approve audit and penetration testing reports, ensuring that findings, risks, evidence, and recommendations are clear and actionable.
• Communicate findings and risks to technical teams, system owners, and senior management.
• Track all findings through to closure: assign corrective actions, follow up on deadlines, and verify remediation.
• Escalate unresolved or overdue risks to the relevant stakeholders and management.
• Provide regular status and progress reports on open risks, remediation plans, and audit actions.
• Identify recurring weaknesses across systems and teams, and recommend improvements to controls, processes, and development practices.

Stakeholder Collaboration

• Work closely with development, infrastructure, security operations, and management teams to understand security requirements and ensure risks are addressed.
• Provide remediation guidance to development and infrastructure teams.
• Coordinate with stakeholders to obtain evidence, clarify findings, and resolve disagreements constructively.

Requirements

• Proven experience in security assessment, penetration testing, vulnerability management, and/or security auditing.
• Experience leading or coordinating a security assessment or audit team.
• Hands-on experience performing both technical security testing and control or compliance audits.
• Strong understanding of security governance, risk management, audit processes, and security controls.
• Solid knowledge of common attack techniques and application, infrastructure, and mobile security concepts.
• Familiarity with OWASP Top 10, OWASP MASVS/MASTG, and other relevant standards and frameworks (ISO 27001, NIST, CIS).
• Practical knowledge of penetration testing methodologies and risk-rating approaches (e.g., CVSS).
• Familiarity with tools such as Burp Suite, OWASP ZAP, MobSF, MitMProxy, Nmap, Nessus/OpenVAS, and similar.
• Familiarity with mobile technologies and languages (Java/Kotlin, Swift/Objective-C, React Native, Xamarin) is a plus.
• Ability to develop, review, and approve audit checklists and assessment criteria.