Department: Information Security Department - Security Engineering Unit
Location: Iraq - Baghdad
Reports To: Information Security Officer
Grade: G3 Specialist
Contract Type: Full-time, project-duration contract
Position PurposeEmbed security throughout the digital platform development lifecycle for a national digital transformation project serving a government entity - from requirements through deployment. Review code and integrations, and issue the security approval outcome for every release.
Key Responsibilities
- * Define security requirements for each component and integration
- Facilitate threat modeling for new components with developers
- Establish and train teams on secure coding standards for .NET, ABP, and React
- Define and implement SAST, SCA, container image scanning, and secrets detection in build pipelines
- Set security blocking thresholds and triage security findings
- Conduct manual security reviews of critical areas, including authorization, audit logging, and external integrations
- Issue a security approval outcome for each release in coordination with penetration testing
- Review API security, authentication, authorization, and external integrations
- Track vulnerabilities in used components
- Maintain secure coding standards and pipeline security-check documentation
RequirementsEducation
- * Bachelor's degree in Software Engineering, Computer Science, Information Security, or a related field
Experience
- * 4-7 years of relevant experience, including at least 2 years in application security
- Prior .NET development experience is preferred
Professional Certifications
- * CSSLP, GWAPT, or OSWE is an advantage
Technical Competencies
- * Knowledge of OWASP Top 10, OWASP ASVS, and OWASP API Security
- Ability to read and review C#, .NET, ABP Framework, React, and TypeScript code
- Hands-on familiarity with SAST, SCA, container scanning, and secrets detection tools, such as SonarQube, Trivy, and Gitleaks
- Knowledge of OAuth 2.0, OpenID Connect, Keycloak, and STRIDE threat modeling
Languages
- * Fluent Arabic
- Very good English reading and technical writing skills
Key Performance Indicators
- * Zero releases without a documented security approval outcome
- Zero open critical vulnerabilities at deployment
- Percentage of new components that complete threat modeling before release
- Average remediation time for code vulnerabilities, by severity
Working Relationships & Conditions
- * Work closely with the Information Security Officer, Security Engineering team, Engineering Management, and Quality Assurance team
- On-site work from the Baghdad office
- Availability to support release windows outside normal business hours when needed
- Successful security vetting is a condition of employment
- Strict confidentiality regarding project data is required
- Preference will be given to Iraqi applicants
