Application Security Specialist: Pen Tests & Secure SDLC

Malomatia; Doha; On-site; QAR 120,000 - 180,000; Full time

Job summary

Malomatia in Doha is seeking an Application Security Specialist to join our Cybersecurity Practice. You will work with application security, development, and QA teams to secure client applications across the lifecycle, conducting testing, penetration testing, and vulnerability assessments.

You will embed security into CI/CD, perform threat modelling, secure code reviews, and deliver remediation guidance to developers, while staying hands-on with tools like Burp Suite and SAST/DAST.

Qualifications

• Bachelor’s degree in Computer Science, Information Security, or related field.
• At least 3 years of experience in application security, secure software development, or related field.
• Relevant professional certifications are desirable (e.g., OSWE, eWPT, GWAPT, BCSP).

Responsibilities

• Penetration testing on web, mobile, APIs, and thick-client apps.
• Security scanning with SAST, DAST, and SCA; provide remediation guidance.
• Threat modelling to identify risks early in design.
• Secure code review across languages with actionable fixes.
• DevSecOps integration: CI/CD security validation.
• Develop and deliver secure coding training sessions.
• Tool evaluation to enhance security testing capabilities.
• Documentation of assessments, vulnerability management, and standards.

Skills

Security testing

Threat modelling

Secure code review

DevSecOps

CI/CD

Education

Bachelor's degree in Computer Science or Information Security

Tools

Burp Suite

Snyk

HCL AppScan

Fortify

Postman

Job description

Malomatia in Doha is seeking an Application Security Specialist to join our Cybersecurity Practice. You will work with application security, development, and QA teams to secure client applications across the lifecycle, conducting testing, penetration testing, and vulnerability assessments.

You will embed security into CI/CD, perform threat modelling, secure code reviews, and deliver remediation guidance to developers, while staying hands-on with tools like Burp Suite and SAST/DAST.