Application Security Engineer

Department

Information Security Department – Security Engineering Unit

Location

Iraq – Baghdad

Reports to

Information Security Officer

Grade

G3 Specialist

Contract type

Full-time, project-duration contract

Position purpose

Embed security throughout the digital platform development lifecycle for a national digital transformation project serving a government entity, from requirements through deployment. Review code and integrations, and issue the security approval outcome for every release.

Key responsibilities

• Define security requirements for each component and integration.
• Facilitate threat modeling for new components with developers.
• Establish secure coding standards for .NET, ABP, and React, and train teams on them.
• Define and implement SAST, SCA, container image scanning, and secrets detection in build pipelines.
• Set security blocking thresholds and triage security findings.
• Conduct manual security reviews of critical areas, including authorization, audit logging, and external integrations.
• Issue a security approval outcome for each release in coordination with penetration testing.
• Review API security, authentication, authorization, and external integrations.
• Track vulnerabilities in components in use.
• Maintain secure coding standards and documentation for pipeline security checks.

Requirements

Education

Bachelor’s degree in Software Engineering, Computer Science, Information Security, or a related field.

Experience

Four to seven years of relevant experience, including at least two years in application security. Prior .NET development experience is preferred.

Professional certifications

CSSLP, GWAPT, or OSWE is an advantage.

Technical competencies

• Knowledge of OWASP Top 10, OWASP ASVS, and OWASP API Security.
• Ability to read and review C#, .NET, ABP Framework, React, and TypeScript code.
• Hands-on familiarity with SAST, SCA, container scanning, and secrets detection tools, such as SonarQube, Trivy, and Gitleaks.
• Knowledge of OAuth 2.0, OpenID Connect, Keycloak, and STRIDE threat modeling.

Languages

• Fluent in Arabic.
• Very good English reading and technical writing skills.

Key performance indicators

• Zero releases without a documented security approval outcome.
• Zero open critical vulnerabilities at deployment.
• Percentage of new components that complete threat modeling before release.
• Average remediation time for code vulnerabilities, by severity.

Working relationships and conditions

• Work closely with the Information Security Officer, Security Engineering team, Engineering Management, and Quality Assurance team.
• On-site work from the Baghdad office.
• Availability to support release windows outside normal business hours when needed.
• Successful security vetting is a condition of employment.
• Strict confidentiality regarding project data is required.
• Preference will be given to Iraqi applicants.