# Application Security Engineer

> Elite Talent · Baghdad, Iraq · Full-time · Posted 2026-11-02

**Workplace:** on_site

## Description

**Department:** Information Security Department - Security Engineering Unit  
**Location:** Iraq - Baghdad  
**Reports To:** Information Security Officer  
**Grade:** G3 Specialist  
**Contract Type:** Full-time, project-duration contract

## Position Purpose

Embed security throughout the digital platform development lifecycle for a national digital transformation project serving a government entity - from requirements through deployment. Review code and integrations, and issue the security approval outcome for every release.

## Key Responsibilities

-   Define security requirements for each component and integration.
-   Facilitate threat modeling for new components with developers.
-   Establish and train teams on secure coding standards for .NET, ABP, and React.
-   Define and implement SAST, SCA, container image scanning, and secrets detection in build pipelines.
-   Set security blocking thresholds and triage security findings.
-   Conduct manual security reviews of critical areas, including authorization, audit logging, and external integrations.
-   Issue a security approval outcome for each release in coordination with penetration testing.
-   Review API security, authentication, authorization, and external integrations.
-   Track vulnerabilities in used components.
-   Maintain secure coding standards and pipeline security-check documentation.

## Requirements

**Education**

-   Bachelor’s degree in Software Engineering, Computer Science, Information Security, or a related field.

**Experience**

-   4-7 years of relevant experience, including at least 2 years in application security.
-   Prior .NET development experience is preferred.

**Professional Certifications**

-   CSSLP, GWAPT, or OSWE is an advantage.

**Technical Competencies**

-   Knowledge of OWASP Top 10, OWASP ASVS, and OWASP API Security.
-   Ability to read and review C#, .NET, ABP Framework, React, and TypeScript code.
-   Hands-on familiarity with SAST, SCA, container scanning, and secrets detection tools, such as SonarQube, Trivy, and Gitleaks.
-   Knowledge of OAuth 2.0, OpenID Connect, Keycloak, and STRIDE threat modeling.

**Languages**

-   Fluent Arabic.
-   Very good English reading and technical writing skills.

## Key Performance Indicators

-   Zero releases without a documented security approval outcome.
-   Zero open critical vulnerabilities at deployment.
-   Percentage of new components that complete threat modeling before release.
-   Average remediation time for code vulnerabilities, by severity.

## Working Relationships & Conditions

-   Work closely with the Information Security Officer, Security Engineering team, Engineering Management, and Quality Assurance team.
-   On-site work from the Baghdad office.
-   Availability to support release windows outside normal business hours when needed.
-   Successful security vetting is a condition of employment.
-   Strict confidentiality regarding project data is required.
-   Preference will be given to Iraqi applicants.

## Apply

[Apply at Elite Talent](https://apply.workable.com/elite-talent/j/0568A2CDD7/apply)

---
Powered by [Workable](https://www.workable.com)