Application Security Lead

Role overview

Security assessment and testing

• Penetration-test web, mobile, API, and thick-client applications; provide detailed reports with risk ratings and actionable remediation.
• Implement, tune, and manage SAST, DAST, and SCA tools to find vulnerabilities in code, configurations, and third-party dependencies.
• Model threats and attack surfaces early in design, and advise on mitigation.
• Review application source code across platforms and languages and provide developer-friendly fixes.

DevSecOps and enablement

• Integrate security tests and controls into CI/CD pipelines for continuous automated validation.
• Deliver secure-coding training and awareness workshops for development teams and stakeholders.
• Evaluate tools and technologies for application security testing and monitoring.
• Maintain documentation on assessments, vulnerability management, security standards, and policies.

Education and experience

• Bachelor’s or college degree in Computer Science, Information Security, or a related field.
• At least 3 years of experience in application security, secure software development, penetration testing, or a related field.

Technical qualifications

• Burp Suite proficiency is required; familiarity with Snyk, HCL AppScan, Fortify, and Postman is preferred.
• Strong secure-coding knowledge and hands-on experience with at least one programming language.
• Familiarity with DevSecOps and CI/CD pipelines is preferred.
• Knowledge of application security frameworks and guidelines, including OWASP Top 10, ASVS, MASVS, WSTG, and MSTG, and understanding of vulnerabilities, exploitation, and remediation.

Certifications and additional knowledge

• Relevant professional certifications are highly desirable; examples include OffSec OSWA or OSWE, eLearnSecurity eWPT or eWPTX, GIAC/SANS SEC542 or GWAPT, BCSP, or similar certifications.
• Knowledge of Qatar National Information Assurance (NIA) is a plus.