Senior Application Security Engineer

About the role

We are seeking a skilled Application Security Senior Engineer to join our Cybersecurity Practice. You will work closely with application security, development, and QA teams to protect client applications throughout their lifecycle, performing security testing, penetration testing, and vulnerability assessments for web, mobile, and API solutions.

Key responsibilities

• Conduct penetration tests on web, mobile, API, and thick‑client applications and deliver detailed reports with risk ratings and remediation guidance.
• Implement, tune, and manage automated security scanning tools (SAST, DAST, SCA) to continuously identify code and configuration vulnerabilities.
• Perform threat modelling early in the design phase and advise on mitigation strategies.
• Review source code for security flaws across multiple platforms and languages, providing developer‑friendly remediation.
• Integrate security testing and controls into CI/CD pipelines to enable continuous validation.
• Develop and deliver secure‑coding training sessions and workshops for development teams.
• Assess and recommend tools and technologies to enhance application security testing capabilities.
• Create and maintain documentation for security assessments, vulnerability management, and application security standards.

Required profile

• Bachelor’s degree in Computer Science, Information Security, or a related field.
• Minimum 4 years of experience in application security, secure software development, or penetration testing.
• Relevant certifications such as OSWA, OSWE, eWPT, SEC542, GWAPT, or similar are highly desirable.
• Strong understanding of secure coding practices, common vulnerability classes, exploitation techniques, and remediation strategies.
• Familiarity with security frameworks and guidelines (OWASP Top 10, ASVS, MASVS, WSTG, MSTG) and knowledge of Qatar National Information Assurance (NIA) is a plus.

Required skills

• Burp Suite (required)
• Snyk, HCL AppScan, Fority, Postman (preferred)
• CI/CD pipeline integration and DevSecOps practices
• Secure coding principles across at least one programming language
• OWASP Top 10 and related security standards