Location · Riyadh, Saudi Arabia
Application security assessments mapped to SAMA and NCA controls
I assess your web and mobile apps, APIs and edge controls remotely from Colombo, visit for the workshops that matter, and map every finding to your controls.
- Riyadh
- UTC+3
- GCC
In short
For organisations in Saudi Arabia, I run application security assessments remote-first from Colombo, with on-site visits to Riyadh or Jeddah for workshops and key phases. I review web and mobile apps, APIs (application programming interfaces), edge protection and monitoring, and map findings to the frameworks you are measured against, such as the Saudi Central Bank (SAMA) Cyber Security Framework and the National Cybersecurity Authority (NCA) Essential Cybersecurity Controls.
How we work together
Remote-first, on-site where it counts.
every working day
The market
What I see in Saudi Arabia.
- Detailed, audited controlsSAMA and NCA frameworks are prescriptive and audited, so evidence matters as much as policy.
- Fast digital build-outBanking, payments and government services are going digital quickly, adding new apps and APIs.
- Data stays close to homeRules on sending personal data abroad shape how a remote assessment handles evidence.
Rules you work under
The frameworks I map findings to in Saudi Arabia.
Findings are written so your risk, audit and compliance teams can use them directly. This is orientation, not legal advice.
- Saudi Central Bank (SAMA)SAMA Cyber Security FrameworkThe cyber security baseline for SAMA-regulated financial institutions, assessed against defined maturity levels.
- National Cybersecurity Authority, Saudi ArabiaEssential Cybersecurity Controls (ECC)Minimum controls for government bodies and critical infrastructure operators, web application security included.
- Saudi Data and Artificial Intelligence AuthorityPersonal Data Protection LawGoverns personal data processed in the Kingdom, with conditions on transfers abroad that affect apps and testing.
Sectors
Who I work with in Saudi Arabia.
- BankingMobile apps, APIs and internet banking that regulators watch closely.Explore
- Fintech & paymentsWallets, payment APIs and apps that ship weekly and must stay trusted.Explore
- InsuranceCustomer and broker portals and partner APIs full of sensitive data.Explore
- TelecomsSelf-care apps, top-ups and busy edges that attract bots and floods.Explore
- GovernmentCitizen services that must stay secure, available and trusted.Explore
Services
Assessments available in Saudi Arabia.
Fixed scope and a fixed fee. Every engagement ends in a prioritised plan you can take to any delivery partner.
- AppSec maturity assessmentScored baseline, gap analysis, 12–24 month roadmap, board summary
- Application architecture reviewThreat model, control coverage map, prioritised fixes
- WAAP & API protection assessmentCoverage gaps, bypass paths, migration or tuning plan
- Mobile app security assessmentMobile threat model, protection policy, MASVS test plan
- Exposure management (CTEM) assessmentPrioritisation model, validation approach, owner playbook, metrics
- Executive briefing or team workshopPlain-language risk briefing or hands-on workshop
- Fractional AppSec advisorRoadmap governance, vendor and design reviews, escalation support
Can you map application security findings to SAMA and NCA controls?
Yes. Each finding is tied to the relevant control areas of the frameworks you report against, such as the Saudi Central Bank (SAMA) Cyber Security Framework or the National Cybersecurity Authority (NCA) Essential Cybersecurity Controls. That lets your compliance team see which gaps affect an upcoming review. I provide the technical evidence and mapping; formal compliance opinions stay with your auditors.
How does a remote assessment work across time zones and weekends?
Riyadh is two and a half hours behind Colombo, and the Saudi working week runs Sunday to Thursday, so Monday to Thursday are the shared working days. Interviews and reviews sit comfortably inside Riyadh’s working day. On-site visits cover the kick-off, workshops and the findings presentation, and are agreed in the scope before work begins.
Can personal data stay in Saudi Arabia during the assessment?
Yes. The Personal Data Protection Law places conditions on transferring personal data abroad, so I avoid taking copies. Evidence is reviewed through supervised screen-shares and read-only access inside your environment, and reports describe findings without including personal data. Handling and deletion terms go into the NDA (non-disclosure agreement) and the scope before work starts.
Which applications should a Saudi bank or fintech review first?
Usually the channels that move money and face the internet: the mobile app, internet banking or merchant portals, and the APIs (application programming interfaces) behind them. Open banking and partner APIs deserve early attention, because each one extends trust to another organisation. Internal applications that hold customer data come next. The assessment confirms the order with evidence.