Application Security Engineer

Department: Information Security Department - Security Engineering Unit
Location: Iraq - Baghdad
Reports To: Information Security Officer
Grade: G3 Specialist
Contract Type: Full-time, project-duration contract

Position Purpose

Embed security throughout the digital platform development lifecycle for a national digital transformation project serving a government entity - from requirements through deployment. Review code and integrations, and issue the security approval outcome for every release.

Key Responsibilities

• Define security requirements for each component and integration.
• Facilitate threat modeling for new components with developers.
• Establish and train teams on secure coding standards for .NET, ABP, and React.
• Define and implement SAST, SCA, container image scanning, and secrets detection in build pipelines.
• Set security blocking thresholds and triage security findings.
• Conduct manual security reviews of critical areas, including authorization, audit logging, and external integrations.
• Issue a security approval outcome for each release in coordination with penetration testing.
• Review API security, authentication, authorization, and external integrations.
• Track vulnerabilities in used components.
• Maintain secure coding standards and pipeline security-check documentation.

Requirements

Education

• Bachelor’s degree in Software Engineering, Computer Science, Information Security, or a related field.

Experience

• 4-7 years of relevant experience, including at least 2 years in application security.
• Prior .NET development experience is preferred.

Professional Certifications

• CSSLP, GWAPT, or OSWE is an advantage.

Technical Competencies

• Knowledge of OWASP Top 10, OWASP ASVS, and OWASP API Security.
• Ability to read and review C#, .NET, ABP Framework, React, and TypeScript code.
• Hands-on familiarity with SAST, SCA, container scanning, and secrets detection tools, such as SonarQube, Trivy, and Gitleaks.
• Knowledge of OAuth 2.0, OpenID Connect, Keycloak, and STRIDE threat modeling.

Languages

• Fluent Arabic.
• Very good English reading and technical writing skills.

Key Performance Indicators

• Zero releases without a documented security approval outcome.
• Zero open critical vulnerabilities at deployment.
• Percentage of new components that complete threat modeling before release.
• Average remediation time for code vulnerabilities, by severity.

Working Relationships & Conditions

• Work closely with the Information Security Officer, Security Engineering team, Engineering Management, and Quality Assurance team.
• On-site work from the Baghdad office.
• Availability to support release windows outside normal business hours when needed.
• Successful security vetting is a condition of employment.
• Strict confidentiality regarding project data is required.
• Preference will be given to Iraqi applicants.