Application Security Engineer

About the role

The Information Security Department's Security Engineering Unit in Baghdad is hiring a full-time, project-duration Application Security Engineer (grade G3 Specialist, reporting to the Information Security Officer). The role embeds security into the development lifecycle of a national digital transformation project for a government entity, from requirements through deployment, reviewing code and integrations and issuing a security approval for every release.

Key responsibilities

• Define security requirements for each component and integration
• Facilitate threat modeling for new components with developers
• Establish and train teams on secure coding standards for .NET, ABP and React
• Implement SAST, SCA, container image scanning and secrets detection in build pipelines
• Set security blocking thresholds and triage security findings
• Perform manual security reviews of critical areas such as authorization, audit logging and external integrations
• Issue a security approval outcome for each release in coordination with penetration testing
• Review API security, authentication and authorization, track component vulnerabilities and maintain secure coding and pipeline documentation

Required profile

• Bachelor's degree in Software Engineering, Computer Science, Information Security or a related field
• 4-7 years of relevant experience, including at least 2 years in application security
• Prior .NET development experience preferred
• CSSLP, GWAPT or OSWE certification is an advantage
• Fluent Arabic and very good English reading and technical writing skills
• On-site work from the Baghdad office; availability to support release windows outside normal hours; strict confidentiality and successful security vetting required; preference for Iraqi applicants

Required skills

• OWASP Top 10, OWASP ASVS and OWASP API Security
• Reading and reviewing C#.NET, ABP Framework, React and TypeScript code
• SAST, SCA, container scanning and secrets detection tools such as SonarQube, Trivy and Gitleaks
• OAuth 2.0, OpenID Connect, Keycloak and STRIDE threat modeling