Public Procurement Regulatory Authority (PPRA) Hiring: Application Security Engineer

Public Procurement Regulatory Authority (PPRA); Pakistan; On-site; PKR 1,800,000 - 2,400,000; Full time

Job summary

Public Procurement Regulatory Authority (PPRA) invites applications for an Application Security Engineer on a lump-sum pay contract in Pakistan. The role focuses on continuous monitoring of application logs, API security, and data protection, using SIEM tools and OWASP Top 10 aligned controls.

The ideal candidate holds at least a Bachelor’s degree in CS/IT or related field, with 5+ years of post-qualification experience in application or information security, including secure software

Qualifications

• Bachelor’s degree in CS/IT or related field from a recognized university.
• Minimum 5 years of post-qualification experience in application security or SOC.
• Experience securing web apps, APIs, databases, and enterprise systems.
• Hands-on with vulnerability assessment tools and secure SDLC practices.

Responsibilities

• Monitor application logs, databases, APIs for anomalies using SIEM tools.
• Lead remediation of security weaknesses per OWASP Top 10 standards.
• Ensure secure configurations, RBAC, and data protection for tender docs.

Skills

Application security

Vulnerability assessment

Incident response

RBAC / access control

Education

Bachelor’s degree (16 years) in CS/IT/CYBER/Software Engineering

Tools

SIEM platforms

OWASP Top 10

SAST/DAST

Vulnerability scanners

Job description

About the Job

Public Procurement Regulatory Authority (PPRA) has announced 1 vacancy for the post of Application Security Engineer (Lump-sum pay).

Job Details

• Department / Organisation: Public Procurement Regulatory Authority (PPRA)


• Post: Application Security Engineer


• Grade: Lump-sum pay


• Job type: Contract


• Vacancies: 1


• Qualification: Minimum a Bachelor’s degree (16 years of education) in Computer Science, Software Engineering, Information Technology, Cybersecurity, or a related discipline from an HEC-recognized university. Mandatory certifications: CEH (Certified Ethical Hacker) CISA (Certified Information Systems Auditor) Experience: Minimum of 5 years of relevant and verifiable post-qualification experience in Application Security, Information Security, or SOC operations. Experience in securing web applications, APIs, databases, and enterprise systems. Hands‑on experience with vulnerability assessment tools, SIEM platforms, and application security testing methodologies (SAST/DAST). Familiarity with regulatory compliance, audit processes, and security documentation within public sector or enterprise environments. Job Description: Continuous monitoring and analysis of application logs, database activities, APIs, and user behavior using SIEM and application security tools to identify suspicious or anomalous activities. Detection, analysis, and response to cybersecurity incidents related to applications, including data breaches, unauthorized data access, and misuse of sensitive procurement and financial information. Oversight and implementation of application security controls, including secure configuration, role‑based access control (RBAC), API security, encryption, and protection of sensitive data such as tender documents and bid securities. Conducting vulnerability assessments, secure code reviews, and coordinating remediation of application‑level and database‑related security weaknesses in alignment with OWASP Top 10 standards. Ensuring secure system integrations with external entities including Banks, AGPR, and other organizational systems at application and data layers. Supporting secure software operations by coordinating with development and DevOps teams on security requirements, patches, configuration changes, and secure SDLC implementation. Supporting compliance with applicable laws, rules, regulations, and information security frameworks such as ISO/IEC 27001. Preparation of application and data security incident reports, audit documentation, compliance reports, and periodic security advisories for management. Participation in security audits, assessments, penetration testing activities, and continuous improvement of application and data security controls. Any other responsibility or task assigned by the Project Director for ensuring the seamless security of the EPADS Application.


• Age limit: Up to 40 years


• Location: Pakistan


• Last date to apply: 20 Nov 2026