Application Security Engineer: Pen Testing & DevSecOps

Employment; Doha; On-site; QAR 240,000 - 360,000; Full time

Benefits offered by this job

None

Job summary

Employment seeks an Application Security Specialist to strengthen the security of applications across their full lifecycle. You will collaborate with development, DevOps, and QA teams to ensure secure design, development, and deployment of web, mobile, API, and thick-client applications.

Key duties include penetration testing, automated security scanning, threat modelling, secure code reviews, and CI/CD security integration as part of a DevSecOps approach.

Qualifications

• 3+ years of experience in application security or penetration testing.
• Strong knowledge of web, mobile, and API security testing.
• Familiar with OWASP Top 10, ASVS, MASVS, WSTG, MSTG and vulnerability remediation.
• Bachelor-level degree in a relevant field is required.

Responsibilities

• Conduct penetration testing across web, mobile, API, and thick-client applications.
• Perform automated security scanning (SAST, DAST, SCA) to identify vulnerabilities.
• Carry out threat modelling during the design phase to identify risks and mitigations.
• Perform secure code reviews and provide remediation guidance to developers.
• Integrate security controls into CI/CD pipelines for DevSecOps workflows.
• Develop and deliver secure coding training and awareness sessions for teams.
• Evaluate and recommend application security tools and technologies.
• Prepare and maintain documentation for security assessments and standards.

Skills

Application security

Penetration testing

Secure coding practices

DevSecOps

Security testing methodologies

Education

Bachelor's degree in Computer Science, Information Security, or related field

Tools

Burp Suite

Snyk

HCL AppScan

Fortify

Postman

Job description

Employment seeks an Application Security Specialist to strengthen the security of applications across their full lifecycle. You will collaborate with development, DevOps, and QA teams to ensure secure design, development, and deployment of web, mobile, API, and thick-client applications.

Key duties include penetration testing, automated security scanning, threat modelling, secure code reviews, and CI/CD security integration as part of a DevSecOps approach.