Application Security Engineer

Department: Information Security Department - Security Engineering Unit Location: Iraq - Baghdad Reports To: Information Security Officer Grade: G3 Specialist Contract Type: Full-time, project-duration contract Position Purpose Embed security throughout the digital platform development lifecycle for a national digital transformation project serving a government entity - from requirements through deployment. Review code and integrations, and issue the security approval outcome for every release. Key Responsibilities Define security requirements for each component and integration Facilitate threat modeling for new components with developers Establish and train teams on secure coding standards for .NET, ABP, and React Define and implement SAST, SCA, container image scanning, and secrets detection in build pipelines Set security blocking thresholds and triage security findings Conduct manual security reviews of critical areas, including authorization, audit logging, and external integrations Issue a security approval outcome for each release in coordination with penetration testing Review API security, authentication, authorization, and external integrations Track vulnerabilities in used components Maintain secure coding standards and pipeline security-check documentation Requirements Education Bachelor's degree in Software Engineering, Computer Science, Information Security, or a related field Experience 4-7 years of relevant experience, including at least 2 years in application security Prior .NET development experience is preferred Professional Certifications CSSLP, GWAPT, or OSWE is an advantage Technical Competencies Knowledge of OWASP Top 10, OWASP ASVS, and OWASP API Security Ability to read and review C#, .NET, ABP Framework, React, and TypeScript code Hands-on familiarity with SAST, SCA, container scanning, and secrets detection tools, such as SonarQube, Trivy, and Gitleaks Knowledge of OAuth 2.0, OpenID Connect, Keycloak, and STRIDE threat modeling Languages Fluent Arabic Very good English reading and technical writing skills Key Performance Indicators Zero releases without a documented security approval outcome Zero open critical vulnerabilities at deployment Percentage of new components that complete threat modeling before release Average remediation time for code vulnerabilities, by severity Working Relationships & Conditions Work closely with the Information Security Officer, Security Engineering team, Engineering Management, and Quality Assurance team On-site work from the Baghdad office Availability to support release windows outside normal business hours when needed Successful security vetting is a condition of employment Strict confidentiality regarding project data is required Preference will be given to Iraqi applicants