Application Security Engineer

QAD is seeking an Application Security Engineer. As an Application Security Engineer, you will contribute to ensuring the security and integrity of our organization's applications and software systems. You will assist in identifying security vulnerabilities, conducting risk assessments, and implementing security measures to protect our applications from potential threats. This role requires familiarity with application security best practices and the ability to collaborate effectively with development teams.

What you’ll do:

• Assist in conducting security assessments and penetration testing of applications.
• Support development teams in code review and analysis for security vulnerabilities.
• Collaborate on integrating security measures into application design.
• Participate in evaluating and recommending security controls for applications.
• Assist in developing and updating threat models, and contribute to mitigation strategies.
• Educate development teams on secure coding practices and stay informed about security threats.
• Support incident response team in investigating and mitigating security incidents.
• Contribute to maintaining documentation on security policies and procedures.
• Assist in generating reports on security assessments and recommendations.
• Work with cross-functional teams to integrate security into the software development lifecycle.
• Collaborate with external security organizations to stay updated on threats and vulnerabilities.
• Maintain automated processes for SCA, DAST, and SAST.
• Integrate security testing tools into CI/CD pipelines for continuous security assessments. (Gitlab, Terraform, AWS Inspector)

Requirements

What you'll need:

• A bachelor's degree in a relevant field such as Computer Science, Information Technology, Cybersecurity, or a related discipline.
• 4-7 years of experience in application security with exposure to AWS, GCP, and cloud architectures.
• Strong programming and scripting skills (Java, Python, TypeScript).
• Effective written and verbal communication skills in English.
• Familiarity with common application security vulnerabilities (OWASP Top 10) and remediation techniques.
• Exposure to tools and techniques for vulnerability assessment, penetration testing, and code review, for example: Veracode, Snyk, SonarQube, Burp Suite.
• Knowledge of security standards, frameworks, and compliance requirements (SAML, OIDC, OAuth, Spring Security).
• Good communication and collaboration skills.
• Relevant certifications such as CISSP, CSSLP, or CEH are a plus.