Senior AppSec Engineer — Lead Secure Design & CI/CD

taraki-search; Karachi Division; On-site; PKR 3,000,000 - 4,200,000; Full time

Job summary

Bykea Technologies in Karachi is seeking a Senior Application Security Engineer to lead threat modeling, secure-by-default designs, and secure software delivery across our applications and infrastructure.

You will implement scalable security solutions, perform dynamic and static analyses, and mentor teams to foster a security-first culture while collaborating with cross-functional engineering groups.

Qualifications

• 5+ years of hands-on experience in Application Security.
• Proficiency in scripting languages (Python, JavaScript).
• Experience integrating SAST/DAST within CI/CD environments.
• Experience with AWS, Kubernetes, Terraform/CloudFormation.
• Understanding of TLS/SSL, HTTP(S) and network protocols.

Responsibilities

• Lead threat modeling and secure design reviews for Bykea's applications and infrastructure.
• Design scalable security solutions to detect and remediate vulnerabilities.
• Drive shift-left security by integrating SAST/DAST and other security tools within CI/CD pipelines.
• Conduct dynamic (DAST) and static (SAST) analysis across microservices and mobile applications.
• Identify, prioritize, and remediate security risks across products, features, and infrastructure.
• Define and enforce best practices for application security across the SDLC.
• Assess and mitigate risks from third-party libraries and dependencies.
• Lead vulnerability triage and remediation efforts with engineering teams.
• Mentor teams and promote a security-first culture across the organization.

Skills

Threat modeling

CI/CD security

SAST/DAST

Python

JavaScript

Cloud security

AWS

Kubernetes

TLS/SSL

Job description

Bykea Technologies in Karachi is seeking a Senior Application Security Engineer to lead threat modeling, secure-by-default designs, and secure software delivery across our applications and infrastructure.

You will implement scalable security solutions, perform dynamic and static analyses, and mentor teams to foster a security-first culture while collaborating with cross-functional engineering groups.