Lead Web App & API Security Engineer

Halian | Managed Services, Recruitment Agency & Contract Staffing; Abu Dhabi Emirate; On-site; AED 279,000 - 469,000; Full time

Job summary

Halian is seeking a Senior Web App Security Engineer in Abu Dhabi to assess, test, and strengthen the security of complex web applications, APIs, and authentication systems across critical business workflows.

You will perform manual and automated penetration testing, validate controls, and drive remediation while collaborating with development and security teams to embed secure coding practices throughout the software delivery lifecycle.

Qualifications

• Minimum 5 years of hands-on experience conducting web application and API penetration testing.
• Strong understanding of modern attack techniques and security testing methodologies.
• Expert knowledge of OWASP Top 10, OWASP API Security Top 10, and WSTG.
• Experience with security automation and vulnerability assessment tools.

Responsibilities

• Perform comprehensive manual and automated penetration testing of web apps, APIs, microservices, and internet-facing services.
• Identify vulnerabilities related to authentication, authorization, session management, input validation, and API security.
• Assess applications against recognized security frameworks and industry best practices.
• Produce risk-based security assessment reports with prioritized remediation recommendations.
• Collaborate with stakeholders to validate fixes and perform security re-testing.

Skills

Web security testing

Penetration testing

Threat modeling

Security testing methodologies

Identity & access management

Tools

Burp Suite Professional

Postman

OWASP ZAP

Nuclei

Semgrep

Job description

Halian is seeking a Senior Web App Security Engineer in Abu Dhabi to assess, test, and strengthen the security of complex web applications, APIs, and authentication systems across critical business workflows.

You will perform manual and automated penetration testing, validate controls, and drive remediation while collaborating with development and security teams to embed secure coding practices throughout the software delivery lifecycle.