Cybersecurity Engineer – Application Security

About the role

The Cybersecurity Engineer – Application Security is responsible for maintaining and enhancing the security posture of SJC IT applications across business and operations. The role works closely with development teams, vendors, and the Information Security Lead to ensure robust security controls throughout the application lifecycle.

Key responsibilities

• Collaborate with application development and maintenance teams to embed security from requirements gathering through SDLC and post‑implementation.
• Coordinate vulnerability assessments and penetration testing for web, on‑premises, mobile, and public‑facing applications.
• Perform static and dynamic security testing using approved tools before go‑live.
• Maintain application security policies, procedures, and risk‑management documentation in line with ISO 27001, NIA, Qatar 2022 cyber‑security requirements, and privacy laws.
• Investigate suspected security breaches, recommend corrective actions, and support incident response activities.
• Assist Risk Management, Internal Audit, and IT in evaluating new or existing applications for compliance with enterprise security standards.
• Provide regular reports on application‑level changes, incidents, and security metrics to the Information Security Lead.

Required profile

• Proven experience in application security within a complex IT environment.
• Strong understanding of security governance, risk management, and compliance frameworks.
• Ability to work with cross‑functional teams and external vendors.
• Excellent analytical and problem‑solving skills.

Required skills

• Vulnerability assessment and penetration testing.
• Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST).
• Knowledge of ISO 27001 and related security standards.
• Application security governance across the SDLC.
• Incident response and security breach investigation.