Senior Manager, Offensive Cyber Security

Role Overview

Senior Manager, Offensive Cyber Security at QNB in Doha, Qatar. The incumbent will assess Information Technology applications and infrastructure across the Group for gaps from IT Security Policies and Standards, undertake vulnerability scanning of IT assets, participate in the QNB Red Team conducting simulated offensive attack exercises, and manage relationships with penetration testing vendors.

Company Overview

QNB, established in 1964 as the country's first Qatari-owned commercial bank, is the largest bank in the Middle East and Africa region. QNB Group's presence extends through subsidiaries and associate companies to more than 31 countries across three continents, serving up to 20 million customers through 1,000 locations and an ATM network of 4,300 machines. The bank employs more than 28,000 staff. QNB maintains credit ratings of A from Standard & Poor's, Aa3 from Moody's, and A+ from Fitch, and ranks as the most valuable bank brand in the Middle East and Africa according to Brand Finance Magazine.

Role Purpose

This highly technical role assesses the Group's IT security posture through vulnerability scanning, penetration testing coordination, and simulated offensive attack exercises. The incumbent supports the organization's security framework by identifying gaps in IT security policies and standards compliance and liaising with internal teams and external vendors to maintain and enhance the Group's information security defenses.

Key Responsibilities

Security Assessment & Evaluation

• Assess the effectiveness of QNB systems, security architecture design, and compliance to IT security policies and relevant standards.
• Perform security assessments of QNB systems.
• Assess the effectiveness of various information security systems and network topologies and evaluate security posture of QNB.
• Undertake vulnerability scanning of IT assets.
• Participate in the QNB Red Team that conducts simulated offensive attack exercises.
• Manage relationships with penetration testing vendors.
• Liaise with external consultants appointed to assess the adequacy and effectiveness of the Group's information security efforts.

Risk Management & Compliance

• Understand and effectively perform your role under the Three Lines of Defense principle to identify, measure, monitor, manage and report risks.
• Ensure systematic good outcomes for clients in accordance with Conduct Risk policy.
• Support the framework of RCSA, KRI, Incident reporting and remediation, as appropriate, in accordance with Operational Risk Management requirements.
• Comply with all applicable legal, regulatory and internal compliance requirements including Group Compliance Policies and Procedures (AML & CTF, Sanctions Policy, Data Protection Policy, Fraud Control Policy, Whistle Blowing Policy, Conflict of Interest and Insider Dealing Policy).
• Provide required support for enforcing the security policies of the organization.
• Maintain appropriate knowledge to ensure full qualification to undertake the role.
• Complete all mandatory training provided by the Bank and attain and maintain required levels of competence.
• Attend mandatory internal and external seminars as instructed by the Bank.

Stakeholder Management & Relationship Building

• Develop close relationships with IT and business teams and understand and manage their requirements for GIS risk services.
• Build and maintain strong and effective relationships with all related departments and units to achieve Group goals and objectives.
• Maintain activities in accordance with Service Level Agreements (SLAs) with internal departments and units to achieve improvements in turn-around time.
• Assist customers in all their queries on Bank's products and seek solutions to their requests.
• Provide timely and accurate data to external and internal Auditors, Compliance, Financial Control and Risk when required.

Strategic & Advisory Services

• Provide ad-hoc consultancy for risks of new technologies and propose potential solutions.
• Identify opportunities and develop new ideas that will lead to improvements.
• Keep Group Information Security Management apprised of the latest security trends and vulnerabilities.
• Analyze complex problems and identify potential solutions by exploring and analyzing diverse alternatives, including risks and potential business impact.
• Make decisions based on necessary information and take measures accordingly.
• Adapt and change behavior or plans to better achieve targets and objectives.

Performance & Financial Management

• Adhere to divisional Key Performance Indicators (KPIs) for performance monitoring and quality measurement purposes.
• Implement KPIs and best practices for Offensive Cyber Security.
• Promote cost consciousness and efficiency and enhance productivity to minimize cost, avoid waste, and optimize benefits for the bank.
• Act within the limits of powers delegated to the incumbent.
• Set high targets and objectives for self and department.
• Take initiative and commit to improving productivity.
• Strive to perform above requested performance levels.

Professional Development

• Identify own strengths and limitations.
• Seek guidance and advice when appropriate to accomplish tasks and perform the role in an effective and efficient way.
• Proactively identify areas for professional development of self and undertake development activities.
• Seek out opportunities to remain current with all developments in professional field.
• Play a constructive role as member of the team.
• Possess understanding of business processes and controls in all related operational areas.

Qualifications & Experience

• Bachelor's degree preferably with a major in Marketing, Banking, Finance, Accounting, Economics, Business Administration or Information Technology (related field of study); Masters preferred.
• At least 8 years of experience in undertaking technical security assessments of complex IT solutions including penetration testing, preferably within a highly rated international bank.
• Experience in undertaking red team activities is beneficial.
• Previous Banking or Big 4 Consultancy work experience is mandatory.
• Professional certification such as CISSP, CISM, CISA is mandatory.
• Professional offensive cybersecurity certifications (SANS, Offensive Security, etc.).

Skills & Competencies

• Expert understanding of information security issues, best practices, and working knowledge of IT systems.
• Strong knowledge of penetration testing tools and techniques of application and infrastructure components.
• Strong knowledge of network topologies, logical access controls and firewalls technologies.
• Excellent oral and written communication skills (including report writing) in English and Arabic.
• Good interpersonal and presentation skills.
• Strong analytical skills and ability to communicate both verbally and in writing with all levels of management.
• Planning, organizing, and analytical ability.
• Results oriented.
• Personal integrity and self-management.
• Ability to make decisions and follow through with initiatives.
• Understanding of relevant laws, regulations, and practices.

Additional Information

• Division: Risk Management
• Department: Risk Management
• Location: Doha, Qatar
• Closing Date: 22-Aug-2026
• Full details are available on the employer's original posting.