Senior Application Security Engineer

Brickstech; Karachi Division; On-site; PKR 2,400,000 - 4,200,000; Full time

Job summary

Brickstech is seeking an experienced Application Security professional to lead threat modeling and secure design reviews across applications and infrastructure. You will design scalable security solutions and push shift-left practices by embedding SAST/DAST into CI/CD pipelines.

You will conduct both DAST and SAST analyses on microservices and mobile apps, prioritize risks, and mentor teams to foster a strong security-focused culture throughout the organization.

Qualifications

• 5+ years of hands-on experience in Application Security.
• Strong proficiency in scripting/development (Python, JavaScript preferred).
• Proven experience integrating and managing security tools (SAST, DAST) within CI/CD environments.
• Solid experience with cloud and infrastructure security (AWS, Kubernetes, Terraform/CloudFormation).
• Demonstrated ability to secure high-scale, high-availability systems.

Responsibilities

• Lead threat modeling and secure design reviews for applications and infrastructure.
• Design and implement scalable security solutions to detect and remediate vulnerabilities.
• Drive shift-left security by integrating SAST/DAST within CI/CD pipelines.
• Conduct dynamic (DAST) and static (SAST) analysis across microservices and mobile apps.
• Identify, prioritize and remediate security risks across products and infra.
• Define and enforce best practices for application security across the SDLC.
• Assess and mitigate risks from third‑party libraries and dependencies.
• Lead vulnerability triage and remediation with engineering teams.
• Act as a security champion, mentoring teams and promoting a security-first culture.

Skills

Python

JavaScript

SAST

DAST

CI/CD

AWS

Kubernetes

Terraform

CloudFormation

Job description

Job Description

What You Will Do

• Lead threat modeling and secure design reviews for Bykea’s applications and infrastructure, ensuring secure‑by‑default architectures
• Design and implement scalable security solutions to proactively detect and remediate vulnerabilities
• Drive “shift-left” security by integrating SAST/DAST and other security tools within CI/CD pipelines
• Conduct advanced dynamic (DAST) and static (SAST) analysis across microservices and mobile applications
• Identify, prioritize, and remediate security risks across products, features, and infrastructure
• Define and enforce best practices for application security across the software development lifecycle (SDLC)
• Assess and mitigate risks from third‑party libraries and dependencies
• Lead vulnerability triage and remediation efforts in collaboration with engineering teams
• Act as a security champion, mentoring teams and promoting a strong security‑first culture across the organization

About You

• 5+ years of hands‑on experience in Application Security, with a strong track record of delivering measurable security improvements
• Strong proficiency in scripting/development (Python, JavaScript preferred)
• Proven experience integrating and managing security tools (SAST, DAST) within CI/CD environments
• Solid experience with cloud and infrastructure security (AWS, Kubernetes, Terraform/CloudFormation)
• Deep understanding of web security principles, TLS/SSL, authentication mechanisms, and network protocols (HTTP/HTTPS, TCP/IP, etc.)
• Experience securing mobile applications, web applications, and microservices‑based architectures
• Demonstrated ability to secure high‑scale, high‑availability systems
• Familiarity with cloud platforms such as AWS or GCP and their security best practices
• Strong collaboration and communication skills, with the ability to influence cross‑functional teams
• Relevant certifications (e.g., OSCP, AWS Security Specialty) are a plus