# Application Security Engineer

**Company:** [Elite Talent](https://jobs.workable.com/companies/6Qm5f6QSytzz6xzVBn1cPm.md)
**Location:** Baghdad, Iraq
**Workplace:** on site
**Employment type:** Full-time

[Apply for this job](https://jobs.workable.com/view/dfc745e5-bef1-4e31-95e0-e387dc899ed8)

## Description

**Department:** Information Security Department - Security Engineering Unit  
**Location:** Iraq - Baghdad  
**Reports To:** Information Security Officer  
**Grade:** G3 Specialist  
**Contract Type:** Full-time, project-duration contract

## Position Purpose

Embed security throughout the digital platform development lifecycle for a national digital transformation project serving a government entity - from requirements through deployment. Review code and integrations, and issue the security approval outcome for every release.

## Key Responsibilities

-   Define security requirements for each component and integration.
-   Facilitate threat modeling for new components with developers.
-   Establish and train teams on secure coding standards for .NET, ABP, and React.
-   Define and implement SAST, SCA, container image scanning, and secrets detection in build pipelines.
-   Set security blocking thresholds and triage security findings.
-   Conduct manual security reviews of critical areas, including authorization, audit logging, and external integrations.
-   Issue a security approval outcome for each release in coordination with penetration testing.
-   Review API security, authentication, authorization, and external integrations.
-   Track vulnerabilities in used components.
-   Maintain secure coding standards and pipeline security-check documentation.

## Requirements

**Education**

-   Bachelor’s degree in Software Engineering, Computer Science, Information Security, or a related field.

**Experience**

-   4-7 years of relevant experience, including at least 2 years in application security.
-   Prior .NET development experience is preferred.

**Professional Certifications**

-   CSSLP, GWAPT, or OSWE is an advantage.

**Technical Competencies**

-   Knowledge of OWASP Top 10, OWASP ASVS, and OWASP API Security.
-   Ability to read and review C#, .NET, ABP Framework, React, and TypeScript code.
-   Hands-on familiarity with SAST, SCA, container scanning, and secrets detection tools, such as SonarQube, Trivy, and Gitleaks.
-   Knowledge of OAuth 2.0, OpenID Connect, Keycloak, and STRIDE threat modeling.

**Languages**

-   Fluent Arabic.
-   Very good English reading and technical writing skills.

## Key Performance Indicators

-   Zero releases without a documented security approval outcome.
-   Zero open critical vulnerabilities at deployment.
-   Percentage of new components that complete threat modeling before release.
-   Average remediation time for code vulnerabilities, by severity.

## Working Relationships & Conditions

-   Work closely with the Information Security Officer, Security Engineering team, Engineering Management, and Quality Assurance team.
-   On-site work from the Baghdad office.
-   Availability to support release windows outside normal business hours when needed.
-   Successful security vetting is a condition of employment.
-   Strict confidentiality regarding project data is required.
-   Preference will be given to Iraqi applicants.