AppSec Lead: Threat Modeling & Secure CI/CD

Brickstech; Karachi Division; On-site; PKR 2,400,000 - 4,200,000; Full time

Job summary

Brickstech is seeking an experienced Application Security professional to lead threat modeling and secure design reviews across applications and infrastructure. You will design scalable security solutions and push shift-left practices by embedding SAST/DAST into CI/CD pipelines.

You will conduct both DAST and SAST analyses on microservices and mobile apps, prioritize risks, and mentor teams to foster a strong security-focused culture throughout the organization.

Qualifications

• 5+ years of hands-on experience in Application Security.
• Strong proficiency in scripting/development (Python, JavaScript preferred).
• Proven experience integrating and managing security tools (SAST, DAST) within CI/CD environments.
• Solid experience with cloud and infrastructure security (AWS, Kubernetes, Terraform/CloudFormation).
• Demonstrated ability to secure high-scale, high-availability systems.

Responsibilities

• Lead threat modeling and secure design reviews for applications and infrastructure.
• Design and implement scalable security solutions to detect and remediate vulnerabilities.
• Drive shift-left security by integrating SAST/DAST within CI/CD pipelines.
• Conduct dynamic (DAST) and static (SAST) analysis across microservices and mobile apps.
• Identify, prioritize and remediate security risks across products and infra.
• Define and enforce best practices for application security across the SDLC.
• Assess and mitigate risks from third‑party libraries and dependencies.
• Lead vulnerability triage and remediation with engineering teams.
• Act as a security champion, mentoring teams and promoting a security-first culture.

Skills

Python

JavaScript

SAST

DAST

CI/CD

AWS

Kubernetes

Terraform

CloudFormation

Job description

Brickstech is seeking an experienced Application Security professional to lead threat modeling and secure design reviews across applications and infrastructure. You will design scalable security solutions and push shift-left practices by embedding SAST/DAST into CI/CD pipelines.

You will conduct both DAST and SAST analyses on microservices and mobile apps, prioritize risks, and mentor teams to foster a strong security-focused culture throughout the organization.