Senior Cyber Security Analyst

Job description

As a Senior Cyber Security Analyst within the Continuous Security Testing department, you will conduct hands-on penetration testing and vulnerability assessments to identify security weaknesses and help reduce cyber risk across Qatar Airways’ technology environment. Your scope will include external black-box testing, enterprise cloud platforms, internal infrastructure and enterprise directory services, Wi-Fi networks, operational technology (OT), kiosks, servers and network devices. You will communicate findings clearly, recommend practical remediation and validate corrective actions in collaboration with technology and business stakeholders.

Responsibilities

• Plan and deliver authorised security assessments in accordance with agreed scope, rules of engagement and testing schedules.
• Document validated findings, assess business impact and recommend actionable, risk-prioritised remediation to technical and non-technical stakeholders.
• Coordinate assessment activities with system owners, safeguard assessment evidence and support security and compliance reporting through established procedures.
• Conduct external black-box penetration testing of internet-facing assets and internal penetration testing, including controlled exploitation of enterprise directory services, to identify and validate weaknesses and demonstrate their impact within the approved scope.
• Perform cloud penetration testing and security assessments across enterprise cloud platforms, covering cloud infrastructure, configurations and access controls.
• Assess Wi-Fi configurations, authentication, access controls and network segregation, and evaluate kiosk configurations, access restrictions and exposure to unauthorised access, recommending appropriate corrective measures.
• Conduct security and vulnerability assessments of in-scope OT systems, including supervisory control and data acquisition (SCADA) and industrial control systems, using approved methods that prioritise operational safety and availability.
• Assess vulnerabilities across active on-premises servers, cloud infrastructure, external IP addresses, network devices and approved OT networks; use enterprise vulnerability management solutions such as Tenable, Qualys, etc., to plan and execute scans, review coverage and analyse results, with manual validation where appropriate to reduce false positives.
• Prioritise vulnerabilities by severity, asset criticality, exposure and business impact; agree practical remediation actions with asset owners, track progress, perform retesting and document closure evidence or remaining risk in accordance with established procedures.
• Maintain assessment plans and testing records for consistent coverage and use approved, industry-standard security testing tools to deliver repeatable assessments within agreed authorisation and operational constraints.
• Produce clear technical reports and management summaries covering assessment scope, evidence, business impact and remediation recommendations.
• Continuously improve testing practices, reporting quality and assessment efficiency, and share relevant technical knowledge with the team.

Requirements

• Bachelor’s degree in cyber security, information technology, computer science or a related field, with a minimum of 4 years of job-related experience.
• Penetration Testing Experience:
• Practical experience conducting external black-box and internal infrastructure penetration testing.
• Hands-on experience assessing Active Directory security and validating weaknesses through authorised testing.
• Experience conducting cloud security assessments and penetration testing across enterprise cloud platforms.
• Vulnerability Assessment and Tools:
• Hands-on experience with enterprise vulnerability management solutions such as Tenable, Qualys, etc., for vulnerability scanning, results analysis and remediation tracking.
• Proficiency with industry-standard security testing tools for infrastructure and network assessments.
• Experience assessing servers, network devices, external IP addresses and cloud infrastructure, including manual validation and retesting.
• Assessment Delivery and Reporting:
• Experience defining assessment scope, following rules of engagement and coordinating testing with system owners.
• Ability to produce evidence-based technical reports, explain business impact and recommend practical remediation.
• Experience prioritising findings and validating remediation in collaboration with infrastructure, network and cloud teams..
• Experience with aviation cyber security frameworks and security assessments across large, geographically dispersed technology environments.
• Hands-on OT assessment experience involving SCADA or industrial control systems..
• One or more of the following certifications:
• OffSec Certified Professional (OSCP / OSCP+)
• OffSec Experienced Penetration Tester (OSEP)
• Certified Red Team Operator (CRTO)
• Certified Red Team Lead (CRTL)
• Certified Azure Red Team Professional (CARTP)
• Strong technical knowledge of network security, enterprise operating systems, directory services and cloud security across enterprise cloud platforms.
• Ability to select appropriate testing methods, validate findings and assess risk without exceeding the authorised scope.
• Practical proficiency with enterprise vulnerability management solutions and industry-standard security testing tools for vulnerability assessment and penetration testing.
• Understanding of wireless security, kiosk restrictions, infrastructure hardening and OT assessment considerations.
• Strong analytical judgement, attention to detail and ability to prioritise findings based on technical severity and business impact.
• Clear written and verbal communication, effective stakeholder coordination and disciplined handling of confidential assessment information.