Application Security Engineer/Penetration Tester

Remotedxb; Dubai; On-site; AED 180,000 - 240,000; Full time

Job summary

Remotedxb in Dubai is seeking an Application Security professional to triage findings from SAST, SCA, and secret scanning tools, conduct code reviews, and perform hands-on pentesting of web apps, microservices, and APIs.

You will audit REST and GraphQL APIs with a focus on authentication, authorization, and business logic, and work with OWASP Top 10 standards. Proficiency in English is required.

Qualifications

• 2-4 years of experience in Application Security, Product Security, or Penetration Testing
• Hands-on experience with the listed security tools
• Knowledge of OWASP Top 10 and API Security Top 10
• Familiarity with identity protocols such as OAuth 2.0, OIDC, JWT, SAML, and RBAC/ABAC
• Intermediate level of English (spoken and written)

Responsibilities

• Triage, validate, and prioritize security findings from SAST, SCA, and Secret scanning tools
• Conduct manual and tool-assisted code reviews to identify security vulnerabilities and logic flaws
• Perform hands-on penetration testing of web applications, microservices, and APIs
• Audit REST and GraphQL APIs focusing on authentication, authorization, and business logic

Skills

Penetration testing

Code review

Security assessment

Tools

Semgrep

OpenGrep

Gitleaks

Trivy

OSV-Scanner

Burp Suite Pro

Nuclei

Subfinder

SQLmap

Metasploit

NetExec

Job description

Responsibilities

• Triage, validate, and prioritize security findings from SAST, SCA, and Secret scanning tools
• Conduct manual and tool-assisted code reviews to identify security vulnerabilities and logic flaws
• Perform hands-on penetration testing of web applications, microservices, and APIs
• Audit REST and GraphQL APIs with a focus on authentication, authorization, and business logic

Requirements

• 2-4 years of experience in Application Security, Product Security, or Penetration Testing
• Hands-on experience with Semgrep, OpenGrep, Gitleaks, Trivy, and OSV-Scanner
• Proficiency with Burp Suite (Pro), Nuclei, Subfinder, SQLmap, Metasploit, and NetExec
• Deep understanding of OWASP Top 10 and OWASP API Security Top 10
• Knowledge of identity protocols including OAuth 2.0, OIDC, JWT, SAML, and RBAC/ABAC
• Intermediate level of English (spoken and written)

Preferred Qualifications

• Ability to read and analyze modern application code
• Understanding of AWS cloud security and Kubernetes (K8s) security fundamentals

About the Company

Growe values teamwork, driving results over process, and adaptability to change.