Senior Application Security Engineer – Diyar United Company
Job Description
We are seeking an experienced Senior Application Security Engineer with a strong focus on DevSecOps and penetration testing. The successful candidate will embed security into our GitLab CI/CD pipelines, perform hands-on testing of web applications, APIs, and cloud infrastructure, and work closely with development teams to identify and fix vulnerabilities early in the software development lifecycle.
Key Responsibilities
• Design and embed security gates in GitLab CI/CD pipelines, including SAST, DAST, dependency scanning, and secret detection.
• Conduct hands-on penetration testing of web applications, APIs, and cloud infrastructure.
• Manage the vulnerability remediation lifecycle: triage, prioritization, tracking, and verification of fixes with application owners.
• Develop automation scripts (Python, Bash, or Go) for vulnerability scanning, orchestration, and reporting.
• Perform secure code reviews and threat modeling of new features and architecture changes in collaboration with development teams.
• Define and maintain secure coding standards, pipeline security policies, and security gate criteria.
• Provide security guidance and coaching to developers, promoting a shift-left, security-by-design culture.
• Prepare clear technical reports, risk ratings, and remediation recommendations for technical and management audiences.
• Track emerging threats, vulnerabilities, and tooling, and continuously improve application security practices.
Minimum Requirements
• Proven experience embedding security gates (SAST, DAST, secret detection) into GitLab CI/CD pipelines.
• Hands-on experience performing web application, API, and cloud infrastructure penetration testing, and managing remediation.
• Strong scripting skills (Python, Bash, or Go) to automate vulnerability scanning and reporting.
• Strong background in software development, with the ability to review code and discuss fixes with developers.
• Experience working closely with development teams on code review, threat modeling, and early-lifecycle vulnerability remediation.
Preferred / Additional Skills
• Security certifications such as OSCP or CEH (OSCP preferred).
• Experience with cloud security (AWS, Azure, or GCP) and container/Kubernetes security.
• Familiarity with Infrastructure-as-Code scanning and software composition analysis (SCA).
• Experience with common security tools such as Burp Suite, OWASP ZAP, and Semgrep or similar SAST tools.
• Exposure to Agile/Scrum delivery methodology.
Experience & Education
• Bachelor’s degree in Computer Science, Information Security, or a related field.
• 5+ years of experience in application security, DevSecOps, or penetration testing.
Job Details
| Posted Date: | 2026-11-12 |
| Job Location: | Kuwait – Al Kuwait |
| Job Role: | Engineering |
| Company Industry: | Accounting |
Preferred Candidate
| Career Level: | Mid Career |
