Application Security Engineer

The Application Security Engineer will be responsible for continuous monitoring, analysis, and response to cybersecurity incidents related to applications, ensuring secure system integrations and compliance with security frameworks.

• Continuous monitoring and analysis of application logs, database activities, APIs, and user behavior using SIEM and application security tools to identify suspicious or anomalous activities.
• Detection, analysis, and response to cybersecurity incidents related to applications, including data breaches, unauthorized data access, and misuse of sensitive procurement and financial information.
• Oversight and implementation of application security controls, including secure configuration, role-based access control (RBAC), API security, encryption, and protection of sensitive data such as tender documents and bid securities.
• Conducting vulnerability assessments, secure code reviews, and coordinating remediation of application-level and database-related security weaknesses in alignment with OWASP Top 10 standards.
• Ensuring secure system integrations with external entities including Banks, AGPR, and other organizational systems at application and data layers.
• Supporting secure software operations by coordinating with development and DevOps teams on security requirements, patches, configuration changes, and secure SDLC implementation.
• Supporting compliance with applicable laws, rules, regulations, and information security frameworks such as ISO/IEC 27001.
• Preparation of application and data security incident reports, audit documentation, compliance reports, and periodic security advisories for management.
• Participation in security audits, assessments, penetration testing activities, and continuous improvement of application and data security controls.
• Any other responsibility or task assigned by the Project Director for ensuring the seamless security of the EPADS Application.

Applicants for Application Security Engineer must hold a Bachelor's degree (16 years of education) in a relevant field and possess mandatory security certifications.

• Education: Minimum a Bachelor's degree (16 years of education) in Computer Science, Software Engineering, Information Technology, Cybersecurity, or a related discipline from an HEC-recognized university.
• Experience: Minimum of 5 years of relevant and verifiable post-qualification experience in Application Security, Information Security, or SOC operations. Experience in securing web applications, APIs, databases, and enterprise systems. Hands-on experience with vulnerability assessment tools, SIEM platforms, and application security testing methodologies (SAST/DAST). Familiarity with regulatory compliance, audit processes, and security documentation within public sector or enterprise environments.
• Certifications: CEH (Certified Ethical Hacker), CISA (Certified Information Systems Auditor).