Application Security Engineer - DevSecOps

DiceTek UAE; Abu Dhabi; On-site; AED 350,000 - 650,000; Full time

Job summary

Dicetek LLC in Abu Dhabi seeks an experienced Application Security Engineer to fortify web, mobile, and API security. You will lead threat modeling, automate security controls in CI/CD, and collaborate with engineering to secure cloud and container environments.

The role emphasizes hands-on testing, secure code reviews, and building secure software delivery practices across AWS/Azure, Kubernetes, and Docker-based setups.

Qualifications

• 7-12 years of professional information security experience.
• Hands-on penetration testing for web, mobile apps and APIs.
• Strong knowledge of DevSecOps, CI/CD security and automated security frameworks.
• Experience with cloud security across AWS and Azure; container security.

Responsibilities

• Conduct penetration testing across web, mobile and APIs.
• Perform secure code reviews to detect weaknesses in source code and configs.
• Configure and manage security scanning tools (SAST/DAST/SCA).
• Assess IaC configurations and container environments with security scans.
• Lead threat modeling and risk assessments across development lifecycles.
• Drive DevSecOps initiatives by integrating security into dev and deployment pipelines.
• Develop automation scripts using Python or Bash.
• Collaborate with DevOps and engineering to remediate vulnerabilities.
• Promote secure development practices and security awareness.

Skills

Penetration testing

Secure code review

DevSecOps

Cloud security

CI/CD security

SAST

DAST

SCA

IaC security scanning

Container security

Kubernetes

Docker

Python Bash scripting

Threat modeling

Tools

SAST tools

DAST tools

SCA tools

Kubernetes

Docker

Cloud security tools

Job description

Application Security Engineer - DevSecOps Job Snapshot - Role: Application Security Engineer - Location: Abu Dhabi, United Arab Emirates - Industry: I T and Services - Function: Computer-Network Security - Experience: 7-12 years - Job Type: Full Time - Work Arrangement: On-site

Dicetek LLC is seeking an experienced Application Security Engineer with strong expertise in penetration testing, secure code review, DevSecOps and cloud security for a full-time, on-site opportunity in Abu Dhabi, United Arab Emirates. The role focuses on identifying and mitigating security risks across web applications, mobile applications, APIs, cloud environments and containerized infrastructure. The successful candidate will contribute to secure software development practices, automate security controls within CI/CD pipelines and work closely with engineering teams to strengthen application and infrastructure security. This position requires a combination of hands‑on technical security capabilities, risk assessment experience and effective stakeholder communication.

Job Details

• Country: United Arab Emirates
• City: Abu Dhabi
• Industry: I T and Services
• Function: Computer-Network Security
• Salary: Not disclosed
• Gender: No Preference
• Candidate Nationality: Not specified
• Job Type: Full Time
• Work Arrangement: On-site

Key Responsibilities

• Conduct penetration testing across web applications, mobile applications and APIs to identify security vulnerabilities.
• Perform secure code reviews to detect weaknesses in application source code, scripts and configuration files.
• Recommend remediation measures and work with technical teams to address identified vulnerabilities.
• Configure, optimize and manage security scanning tools covering static application security testing (SAST), dynamic application security testing (DAST) and software composition analysis (SCA).
• Assess Infrastructure as Code (IaC) configurations and container environments using appropriate security scanning technologies.
• Lead threat modeling activities and evaluate application security risks throughout the development lifecycle.
• DevSecOps and Security Automation - Drive DevSecOps initiatives by integrating security practices into software development and deployment processes.
• Implement and enhance automated security controls within continuous integration and continuous delivery pipelines.
• Develop scripts and automation workflows using Python, Bash or similar technologies.
• Collaborate with development and DevOps teams to identify security issues early and support timely remediation.
• Promote secure development practices through practical security automation and technical guidance.
• Cloud and Container Security - Assess and improve security controls across AWS and Microsoft Azure environments.
• Strengthen the security posture of Kubernetes clusters, Docker environments, container runtimes and supporting infrastructure.
• Review application, cloud and infrastructure architecture to identify security weaknesses and potential risks.
• Contribute to secure architecture design and provide recommendations aligned with established security principles.
• Support security reviews for containerized applications and cloud-native deployment environments.
• Risk Management and Incident Response - Lead security risk assessments, threat modeling and vulnerability management activities.
• Evaluate technical findings and communicate their potential impact to relevant stakeholders.
• Recommend practical risk mitigation measures based on identified vulnerabilities and security requirements.
• Participate in security incident response activities and contribute to post-incident reviews.
• Help ensure lessons learned from security incidents are incorporated into future security improvements.
• Monitor emerging cybersecurity threats, attack techniques and security technologies to maintain awareness of evolving risks.
• Security Awareness and Collaboration - Develop and deliver security awareness sessions, technical training and best-practice workshops.
• Work closely with software development, DevOps, infrastructure and product teams to promote secure system design and delivery.
• Provide security guidance to technical and non-technical stakeholders.
• Translate complex security risks into clear, actionable recommendations for business and leadership teams.
• Encourage a collaborative security culture and support continuous improvement in security practices.

Required Experience and Technical Skills

• 7-12 years of professional experience in information security roles.
• Demonstrated hands‑on experience conducting penetration testing for web applications, mobile applications and APIs.
• Strong proficiency with SAST, DAST, SCA, Infrastructure as Code security scanning and container security tools.
• In-depth understanding of DevSecOps methodologies, CI/CD pipeline security and automated security frameworks.
• Strong knowledge of cloud security practices across AWS and Microsoft Azure.
• Practical understanding of Kubernetes, Docker, container runtime security and secure architecture principles.
• Proficiency in Python, Bash or similar scripting languages for developing security automation workflows.
• Experience conducting threat modeling, security risk assessments and vulnerability management.
• Ability to assess application and infrastructure security issues and recommend appropriate remediation strategies.

Professional and Interpersonal Skills

• Strong analytical thinking and structured problem‑solving capabilities.
• Excellent written and verbal communication skills.
• Ability to explain technical vulnerabilities and security risks to non-technical audiences.
• Effective stakeholder management and cross‑functional collaboration skills.
• Experience working with development, DevOps, product, infrastructure and leadership teams.
• Commitment to continuous learning and maintaining awareness of emerging security threats.
• Ability to promote security awareness and encourage the adoption of secure engineering practices.

Preferred Certifications

• Offensive Security Certified Professional (OSCP).
• Offensive Security Web Expert (OSWE).
• Offensive Security Experienced Penetration Tester (OSEP).
• Certified Information Systems Security Professional (CISSP).
• Certified Cloud Security Professional (CCSP).
• Certified Kubernetes Security Specialist (CKS).
• Certified Kubernetes Administrator (CKA).

Additional Knowledge and Experience

• ISO 27001.
• SOC 2.
• NIST cybersecurity frameworks.
• CIS security controls and benchmarks.
• General Data Protection Regulation (GDPR).
• Payment Card Industry Data Security Standard (PCI DSS).
• Health Insurance Portability and Accountability Act (HIPAA).

Candidate Profile

The ideal candidate will be a technically capable information security professional who can combine hands‑on penetration testing and application security expertise with broader DevSecOps, cloud security and risk management responsibilities. The position requires a proactive approach to identifying vulnerabilities, improving security automation and supporting secure software delivery. Strong collaboration skills and the ability to provide practical security guidance across engineering and business teams will be essential.