Engineer - Application Security

Malomatia; Doha; On-site; QAR 120,000 - 180,000; Full time

Job summary

Malomatia in Doha is seeking an Application Security Specialist to join our Cybersecurity Practice. You will work with application security, development, and QA teams to secure client applications across the lifecycle, conducting testing, penetration testing, and vulnerability assessments.

You will embed security into CI/CD, perform threat modelling, secure code reviews, and deliver remediation guidance to developers, while staying hands-on with tools like Burp Suite and SAST/DAST.

Qualifications

• Bachelor’s degree in Computer Science, Information Security, or related field.
• At least 3 years of experience in application security, secure software development, or related field.
• Relevant professional certifications are desirable (e.g., OSWE, eWPT, GWAPT, BCSP).

Responsibilities

• Penetration testing on web, mobile, APIs, and thick-client apps.
• Security scanning with SAST, DAST, and SCA; provide remediation guidance.
• Threat modelling to identify risks early in design.
• Secure code review across languages with actionable fixes.
• DevSecOps integration: CI/CD security validation.
• Develop and deliver secure coding training sessions.
• Tool evaluation to enhance security testing capabilities.
• Documentation of assessments, vulnerability management, and standards.

Skills

Security testing

Threat modelling

Secure code review

DevSecOps

CI/CD

Education

Bachelor's degree in Computer Science or Information Security

Tools

Burp Suite

Snyk

HCL AppScan

Fortify

Postman

Job description

Job Description

The Application Security Specialist will be part of our Cybersecurity Practice, working closely with application security, development, and QA teams to secure our clients’ applications across their entire lifecycle. The role involves conducting security testing, performing penetration tests, and assessing vulnerabilities across web, mobile, and API applications.

Responsibilities span application penetration testing, automated security scanning (SAST, DAST, SCA), threat modelling, secure code review, and developer enablement. The role focuses on embedding security best practices throughout the software development lifecycle and ensuring that applications are designed and built with robust security controls.

The specialist will collaborate with development and DevOps teams to integrate security into CI/CD pipelines, triage and validate findings, and provide clear, actionable remediation guidance. The role requires hands‑on technical expertise, strong analytical skills, and the ability to translate complex security findings into practical fixes that developers can implement.

Responsibilities

• Penetration Testing:Conduct penetration tests on web applications, mobile applications, APIs, and thick‑client applications. Prepare detailed reports with clear risk ratings and actionable remediation recommendations.
• Security Scanning:Implement, tune, and manage automated security scanning tools (SAST, DAST, SCA) to continuously identify vulnerabilities in code, configurations, and third‑party dependencies across all application types.
• Threat Modelling:Perform threat modelling to identify potential security risks and attack surfaces associated with applications early in the design process, and provide guidance on mitigating these risks.
• Secure Code Review:Review application source code for security vulnerabilities across multiple platforms and languages, and offer practical, developer‑friendly recommendations for remediation.
• DevSecOps Integration:Integrate security testing and controls into CI/CD pipelines, enabling continuous and automated security validation as part of the development workflow.
• Training & Awareness:Develop and deliver secure coding training sessions and workshops to raise application security awareness among development teams and other stakeholders.
• Tool Evaluation:Assess and recommend tools and technologies to enhance application security testing and monitoring capabilities across various platforms.
• Documentation:Create and maintain comprehensive documentation related to security assessments, vulnerability management, and application security standards and policies.

Qualifications

Education

Bachelor’s / college degree in Computer Science, Information Security, or a related field.

Experience

At least 3 years of experience in application security, secure software development, penetration testing, or a closely related field.

Certifications

Relevant professional certifications are highly desirable. These may include, but are not limited to:

• OffSec certifications (e.g., OSWA, OSWE)
• eLearnSecurity (e.g., eWPT, eWPTX)
• GIAC / SANS (e.g., SEC542, GWAPT)
• BCSP or other application security certifications.

Technical Skills

Proficiency with security testing tools such as Burp Suite (required), and familiarity with Snyk, HCL AppScan, Fority, and Postman (preferred). Strong understanding of secure coding practices and hands‑on experience with at least one programming language. Familiarity with DevSecOps practices and CI/CD pipelines is preferred.

Knowledge

In-depth knowledge of application security principles and practices, with strong familiarity with security frameworks and guidelines (e.g., OWASP Top 10, ASVS, MASVS, WSTG, MSTG). Understanding of common vulnerability classes, exploitation techniques, and remediation strategies. Knowledge of Qatar National Information Assurance (NIA) is a plus.