Application Security Engineer

This is a fully remote position, open to applicants in Jordan.

📋 Description

• Identify, validate, and address application and API vulnerabilities across digital platforms.

• Evaluate security findings from Wiz, Qualys, and automated or AI-driven penetration testing tools.

• Replicate exploits, pinpoint false positives, and assess exploitability, business impact, data exposure, and overall risk.

• Monitor vulnerability remediation until closure and review developer fixes.

• Offer code-level remediation guidance and suggest root-cause solutions.

• Conduct manual security testing of web applications and REST and GraphQL APIs.

• Test for vulnerabilities including authentication, authorization, BOLA/IDOR, privilege escalation, session management, injection, business logic, and the OWASP API Security Top 10.

• Investigate shadow and undocumented APIs to evaluate their exposure and associated risks.

• Perform secure code reviews and threat modeling for application features, APIs, and integrations.

• Manage and enhance SAST and DAST programs using tools like Snyk, SonarQube, and Qualys WAS.

• Configure and maintain authenticated DAST scans while minimizing false positives.

• Correlate findings from Snyk, SonarQube, Qualys, and Wiz across source code and production environments.

• Integrate security testing into development workflows and CI/CD pipelines.

• Assess AWS IAM, S3, API Gateway, Lambda, secrets management, and other configurations impacting application security.

• Validate cloud-to-application attack paths identified by Wiz.

• Review AWS WAF rules and provide recommendations for protective measures.

• Utilize AWS Security Hub, GuardDuty, and Inspector findings for investigations and risk prioritization.

• Track vulnerability trends, remediation SLAs, and the overall application security posture.

• Report findings and recommendations to engineering and security leadership.

• Collaborate with development, cloud, and security teams to enhance application security and vulnerability management.

⛳️ Requirements

• Bachelor’s degree in Information Security, Computer Science, Software Engineering, or a related field, or equivalent practical experience.

• Over 5 years of hands-on experience in application security, penetration testing, or vulnerability research.

• Expertise in identifying and exploiting business logic flaws and access control vulnerabilities in REST and GraphQL APIs.

• In-depth knowledge of the OWASP Top 10 and OWASP API Security Top 10.

• Proficient with Burp Suite Professional, including request manipulation and custom test case development.

• Experience in operating, configuring, and tuning SAST and DAST tools such as Snyk, SonarQube, and Qualys.

• Ability to read, analyze, and review application code written in Python, Java, Go, or JavaScript/TypeScript.

• Familiarity with AWS IAM, S3, Lambda, and API Gateway security configurations.

• Experience with Wiz, Qualys, or similar CNAPP and vulnerability management platforms.

• Proven track record of integrating security testing into development workflows and collaborating with developers on secure coding practices.

• Understanding of vulnerability assessment, exploit validation, risk-based prioritization, and remediation lifecycle management.

• Experience with SOAR platforms, including constructing playbooks and integrations.

• Knowledge of automated or AI-assisted penetration testing and continuous DAST platforms.

• Background in developing custom security rules and quality profiles in SonarQube or Snyk.

• AWS Certified Security – Specialty certification.

• Offensive security certifications such as OSCP, OSWE, BSCP, or GWAPT.

• Involvement in bug bounty programs or experience in publishing vulnerability research.

• Strong written and verbal communication skills for providing developer-focused remediation guidance and creating security reports.

• Ability to influence development teams, drive remediation without direct authority, and work independently in a fast-paced remote environment.

• Awareness or knowledge of IT security best practices as defined by ISO/SOC or similar standards.

🏝️ Benefits

• Competitive long-term total compensation package including salary and performance-based bonuses.

• Remote-first organization offering flexibility.

• Access to technical and non-technical training programs.

• Global exposure through products developed with international teams and clients.

• Opportunities to attend virtual and in-person international technology conferences.

• Experience in an IT environment that adheres to strict ISO/SOC security and compliance standards.