Jobgether تعلن عن وظيفة مهندس أمن تطبيقات أول في السعودية
Staff Application Security Engineer
تفاصيل الوظيفة
Jobgether تعلن نيابة عن شركة شريكة عن وظيفة Staff Application Security Engineer في السعودية. تهدف هذه الوظيفة إلى تأسيس وتوسيع نطاق وظيفة أمن التطبيقات داخل بيئة تقنية عالية النمو، حيث حماية العملاء من الاحتيال وإساءة الاستخدام تمثل أولوية أساسية.
المهام والمسؤوليات
- تصميم وتنفيذ دورة حياة تطوير آمنة (SDLC)، تتضمن متطلبات الأمان، ونمذجة التهديدات في مرحلة التصميم، ومراجعات الكود الآمنة، والاختبارات قبل الإصدار ضمن سير العمل الهندسي الحالي.
- امتلاك وتحسين أدوات أمن التطبيقات، بما في ذلك SAST/DAST، وSCA، وفحص التبعيات، وكشف الأسرار، وفحص الحاويات والبنية التحتية ككود.
- دمج أدوات الأمان في خطوط CI/CD، وتقليل النتائج الإيجابية الخاطئة، ووضع ملكية واضحة للثغرات واتفاقيات مستوى الخدمة (SLAs) للمعالجة، وضمان أن تؤدي النتائج إلى إجراءات ذات معنى.
- تطوير نهج أمني يعتمد على الذكاء الاصطناعي باستخدام التصنيف الآلي للثغرات، والمعالجة الآلية، وعوامل مراجعة الأمان، والاختبار المعزز بالذكاء الاصطناعي، مع ضوابط قائمة على الأدلة تحكم ما يمكن لهذه الأدوات الإبلاغ عنه أو حظره أو إصلاحه.
- بناء أنماط أمان قابلة لإعادة الاستخدام، ومكتبات محصنة، وإعدادات افتراضية آمنة للمصادقة، والترخيص، والتحقق من المدخلات، وإدارة الأسرار، والعمليات التشفيرية.
- المساهمة مباشرة في قواعد كود الإنتاج من خلال تنفيذ إصلاحات أمنية، وتطوير مكتبات أمان، وبناء أتمتة وتكاملات CI.
- قيادة نمذجة التهديدات ومراجعات أمان البنية للمنتجات والميزات الجديدة والتغييرات التقنية الكبيرة عبر APIs، وSDKs للويب والجوال، ولوحات التحكم، وخطوط البيانات.
- إدارة تحديد الثغرات، وتقييم المخاطر، وتحديد الأولويات، والمعالجة للنتائج الصادرة عن ماسحات الأمان، واختبارات الاختراق، وتقارير برامج المكافآت، وإفصاحات العملاء.
- إجراء اختبارات أمان عملية، بما في ذلك مراجعة الكود اليدوية واختبار الاستغلال لنقاط ضعف المصادقة والترخيص، وثغرات API، وهجمات الحقن، وSSRF، وعيوب منطق الأعمال، وسيناريوهات إساءة الاستخدام.
- إيلاء اهتمام خاص للتهديدات العدائية المتعلقة بكشف الاحتيال وتخفيف البوتات، وتحديد نقاط الضعف التي قد تسمح للمهاجمين بتجاوز حماية المنصة أو تقويضها.
- التعاون مع فرق اختبار الاختراق والامتثال لتحديد نطاق التقييمات، والتحقق من الإصلاحات، وإعادة اختبار النتائج، وترجمة الاكتشافات التقنية إلى أعمال هندسية قابلة للتنفيذ.
- قيادة التحقيقات التقنية لحوادث الأمان على مستوى التطبيق، وتنسيق الاحتواء، وتحليل السبب الجذري، والمعالجة، والتعاون مع فرق البنية التحتية السحابية عند الحاجة.
- تحديد متطلبات تسجيل الأمان والتنبيهات على مستوى التطبيق، والشراكة مع فرق الهندسة والمنصة السحابية لتنفيذ قدرات كشف فعالة.
- دعم الفرق الهندسية من خلال استشارات أمنية، وساعات مكتبية، وتوجيهات حول البرمجة الآمنة، وبرنامج أبطال الأمان (Security Champions) الذي يوسع نطاق الخبرة الأمنية عبر المؤسسة.
- تطوير تدريب عملي على البرمجة الآمنة بناءً على كود التطبيق الفعلي والثغرات والدروس المستفادة من الحوادث الأمنية.
- إرشاد المهندسين من خلال مراجعات الكود وملاحظات البنية، مما يساعد في تحسين الوعي الأمني وجودة الهندسة دون الاعتماد فقط على التفويضات.
- الشراكة مع قيادة أمن التطبيقات لتشكيل الأولويات التقنية، وإبلاغ النتائج وتقييمات المخاطر، وتنفيذ المبادرات التي تقدم خارطة الطريق الأمنية الأوسع.
- تقديم أدلة تقنية للضوابط الأمنية، والمساهمة في تقييمات أمان البائعين، ودعم العناية الواجبة لعملاء المؤسسات، والاستبيانات الأمنية، ومناقشات البنية، وملخصات اختبار الاختراق.
الشروط والمتطلبات
- خبرة لا تقل عن 8 سنوات في هندسة البرمجيات و/أو هندسة الأمان، بما في ذلك 5 سنوات أو أكثر تركز على أمن التطبيقات.
- خبرة في بناء أو تحسين برامج أمن التطبيقات داخل مؤسسة هندسة منتجات، مع تركيز قوي على التنفيذ العملي بدلاً من الاستشارة أو التدقيق فقط.
- أساسيات قوية في هندسة البرمجيات والقدرة على كتابة كود إنتاجي بلغة TypeScript أو JavaScript أو Go أو Python أو لغة مماثلة.
- الإلمام بتطبيقات الويب الحديثة، وواجهات API، وهياكل البرمجيات، ومستودعات الكود المصدري، وخطوط CI/CD.
- خبرة عملية عميقة في أمن التطبيقات، بما في ذلك OWASP Top 10 والثغرات ذات الصلة، وتصميم المصادقة والترخيص، وأمن API، وهجمات الحقن، وSSRF، وإساءة استخدام التشفير، وعيوب منطق الأعمال، وسيناريوهات إساءة الاستخدام.
- القدرة على تحديد الثغرات من خلال الاختبار اليدوي، وشرح تأثيرها في العالم الحقيقي، واقتراح إصلاحات عملية يمكن للفرق الهندسية تنفيذها.
- خبرة مثبتة في قيادة نمذجة التهديدات ومراجعات أمان البنية للأنظمة المعقدة، وإنتاج نماذج تهديد تفيد القرارات الهندسية.
- خبرة في نشر وتكوين وضبط أدوات SAST وDAST وSCA وكشف الأسرار والأدوات الأمنية ذات الصلة ضمن سير عمل CI/CD.
- خبرة عملية في استخدام أدوات الأمان المدعومة بالذكاء الاصطناعي لتحليل الكود، أو تصنيف الثغرات، أو المعالجة الآلية في بيئات حقيقية.
- استخدام منتظم لوكلاء الذكاء الاصطناعي في العمل الأمني، مع فهم واضح لقيودهم وموثوقيتهم وإيجابياتهم الكاذبة.
عرض النص الأصلي للإعلان
This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Staff Application Security Engineer based in Saudi Arabia.
Help establish and scale a dedicated application security function within a high-growth technology environment where protecting customers against fraud and abuse is a core priority. As a senior individual contributor, you will combine deep security expertise with hands-on software engineering to identify vulnerabilities, strengthen development workflows, and build practical security tooling. You will design secure software development practices, lead threat modeling and security reviews, and drive vulnerability remediation across complex APIs, SDKs, and cloud-based systems. Working closely with engineering teams and security leadership, you will integrate AI-powered tools into security testing and remediation while maintaining rigorous quality standards. This role offers substantial technical autonomy, opportunities to influence engineering practices across the organization, and the chance to solve challenging security problems at scale. You will help make security an integral part of product development rather than a separate compliance requirement.
Accountabilities
As a Staff Application Security Engineer, you will serve as the technical foundation of the application security function, translating security strategy into effective engineering practices, tools, and measurable improvements. Your responsibilities will include:
The ideal candidate is an accomplished security engineer who combines strong software development skills with extensive practical application security experience. You should be comfortable independently driving complex initiatives, working directly within engineering repositories, and influencing technical decisions across teams. Required qualifications include:
We use an AI-powered matching process to ensure your application is reviewed quickly, objectively, and fairly against the role's core requirements. Our system identifies the top-fitting candidates, and this shortlist is then shared directly with the hiring company. The final decision and next steps (interviews, assessments) are managed by their internal team.
We appreciate your interest and wish you the best!
Why Apply Through Jobgether?
Data Privacy Notice: By submitting your application, you acknowledge that Jobgether will process your personal data to evaluate your candidacy and share relevant information with the hiring employer. This processing is based on legitimate interest and pre-contractual measures under applicable data protection laws (including GDPR). You may exercise your rights (access, rectification, erasure, objection) at any time.
We may use artificial intelligence (AI) tools to support parts of the hiring process, such as reviewing applications, analyzing resumes, or assessing responses and identifying potential inconsistencies or verification signals in application materials based on available information. These tools assist our recruitment team but do not replace human judgment. Final hiring decisions are ultimately made by humans. If you would like more information about how your data is processed, please contact us.
Help establish and scale a dedicated application security function within a high-growth technology environment where protecting customers against fraud and abuse is a core priority. As a senior individual contributor, you will combine deep security expertise with hands-on software engineering to identify vulnerabilities, strengthen development workflows, and build practical security tooling. You will design secure software development practices, lead threat modeling and security reviews, and drive vulnerability remediation across complex APIs, SDKs, and cloud-based systems. Working closely with engineering teams and security leadership, you will integrate AI-powered tools into security testing and remediation while maintaining rigorous quality standards. This role offers substantial technical autonomy, opportunities to influence engineering practices across the organization, and the chance to solve challenging security problems at scale. You will help make security an integral part of product development rather than a separate compliance requirement.
Accountabilities
As a Staff Application Security Engineer, you will serve as the technical foundation of the application security function, translating security strategy into effective engineering practices, tools, and measurable improvements. Your responsibilities will include:
- Design and implement a secure software development lifecycle (SDLC), incorporating security requirements, design-time threat modeling, secure code reviews, and pre-release testing into existing engineering workflows.
- Own and improve application security tooling, including static and dynamic application security testing (SAST/DAST), software composition analysis (SCA), dependency scanning, secrets detection, and container and infrastructure-as-code scanning.
- Integrate security tools into CI/CD pipelines, reduce false positives, establish clear vulnerability ownership and remediation service-level agreements (SLAs), and ensure findings lead to meaningful action.
- Develop an AI-first security engineering approach using AI-assisted vulnerability triage, automated remediation, security review agents, and AI-augmented testing, with evidence-based controls governing what these tools can flag, block, or fix.
- Build reusable security patterns, hardened libraries, and secure defaults for authentication, authorization, input validation, secrets management, and cryptographic operations.
- Contribute directly to production codebases by implementing security fixes, developing security libraries, and building automation and CI integrations.
- Lead threat modeling and architecture security reviews for new products, features, and significant technical changes across APIs, web and mobile SDKs, dashboards, and data pipelines.
- Manage vulnerability identification, risk assessment, prioritization, and remediation for findings from security scanners, penetration tests, bug bounty reports, and customer disclosures.
- Conduct hands-on security testing, including manual code review and exploitation testing for authentication and authorization weaknesses, API vulnerabilities, injection attacks, server-side request forgery (SSRF), business-logic flaws, and abuse scenarios.
- Pay particular attention to adversarial threats involving fraud detection and bot mitigation, identifying weaknesses that could allow attackers to bypass or undermine platform protections.
- Collaborate with penetration testing and compliance specialists to scope assessments, validate fixes, retest findings, and translate technical discoveries into actionable engineering work.
- Lead technical investigations of application-layer security incidents, coordinating containment, root-cause analysis, remediation, and collaboration with cloud infrastructure teams when necessary.
- Define application security logging and alerting requirements and partner with engineering and cloud platform teams to implement effective detection capabilities.
- Support engineering teams through security consultations, office hours, secure coding guidance, and a Security Champions program that expands security expertise across the organization.
- Develop practical secure coding training based on real application code, vulnerabilities, and lessons learned from security incidents.
- Mentor engineers through code reviews and architecture feedback, helping improve security awareness and engineering quality without relying solely on mandates.
- Partner with application security leadership to shape technical priorities, communicate findings and risk assessments, and execute initiatives that advance the broader security roadmap.
- Provide technical evidence for security controls, contribute to vendor security assessments, and support enterprise customer due diligence, security questionnaires, architecture discussions, and penetration testing summaries.
The ideal candidate is an accomplished security engineer who combines strong software development skills with extensive practical application security experience. You should be comfortable independently driving complex initiatives, working directly within engineering repositories, and influencing technical decisions across teams. Required qualifications include:
- At least 8 years of experience in software engineering and/or security engineering, including 5 or more years focused on application security.
- Experience building or improving application security programs within a product engineering organization, with a strong emphasis on hands-on implementation rather than consulting or auditing alone.
- Strong software engineering fundamentals and the ability to write production-quality code in TypeScript, JavaScript, Go, Python, or a comparable language.
- Familiarity with modern web applications, APIs, software architectures, source code repositories, and CI/CD pipelines.
- Deep practical application security expertise, including OWASP Top 10 and related vulnerabilities, authentication and authorization design, API security, injection attacks, SSRF, cryptographic misuse, business-logic flaws, and abuse scenarios.
- Ability to identify vulnerabilities through manual testing, explain their real-world impact, and propose practical fixes that engineering teams can implement.
- Demonstrated experience leading threat modeling and architecture security reviews for complex systems and producing threat models that inform engineering decisions.
- Experience deploying, configuring, and tuning SAST, DAST, SCA, secrets detection, and related security tooling within CI/CD workflows.
- Practical experience using AI-assisted security tools for code analysis, vulnerability triage, or automated remediation in real-world environments.
- Regular use of AI agents in security work, with a clear understanding of their limitations, reliability, false-positive risks, and appropriate level of autonomy.
- Experience owning vulnerability management processes, including triage, severity classification, remediation tracking, penetration testing follow-up, and enforcement of remediation SLAs.
- Proven ability to influence engineering teams through technical credibility, effective collaboration, well-designed tools, and actionable guidance rather than formal authority alone.
- Excellent written and verbal communication skills, including the ability to produce precise security findings and explain technical risks to engineers, leadership, and customer security teams.
- Strong analytical skills, sound technical judgment, and the ability to work independently on ambiguous, multi-quarter initiatives.
- Experience in fraud detection, bot mitigation, identity security, or device intelligence.
- Strong cloud security knowledge, particularly AWS IAM, network boundaries, secrets management, and workload identity.
- Familiarity with cloud security posture management tools such as Wiz or equivalent solutions.
- Experience securing client-side applications and mobile SDKs, including browser security, anti-tampering techniques, obfuscation tradeoffs, and iOS or Android SDK hardening.
- Experience with multi-tenant SaaS platforms and high-volume, latency-sensitive APIs.
- Experience operating a bug bounty program through platforms such as HackerOne, Bugcrowd, or equivalent services.
- Awareness of AI and machine learning security risks, including prompt injection, LLM-integrated features, agent permissions, and model or data-pipeline vulnerabilities.
- Experience with autonomous or AI-augmented penetration testing and attack simulation, including an understanding of how these approaches complement human-led testing.
- Relevant security certifications, such as OSCP, OSWE, GWAPT, or CSSLP, or evidence of security research, published CVEs, or open-source security contributions.
- Experience implementing or supporting SOC 2 or ISO 27001 controls as the engineering owner responsible for making them operational.
- Annual base salary ranging from $177,000 to $240,000, depending on location, experience, and expertise.
- Location-based salary examples include $209,000-$240,000 for New York City and $177,000-$204,000 for Chicago.
- Fully remote work environment, subject to geographic and regulatory restrictions.
- Significant technical autonomy and the opportunity to shape the application security function from its early stages.
- Executive-level support for application security initiatives and collaboration with dedicated security leadership.
- Opportunity to focus on hands-on engineering, security tooling, vulnerability discovery, and remediation rather than primarily administrative compliance work.
- Access to an established security technology environment that includes tools such as Snyk, Wiz, Cloudflare, and Okta.
- Collaboration with cloud platform, engineering, and compliance specialists who treat security as a shared responsibility.
- Opportunities to influence enterprise security practices and protect high-volume systems against sophisticated fraud and abuse threats.
- An inclusive, globally distributed working environment that values diverse perspectives and professional contributions.
We use an AI-powered matching process to ensure your application is reviewed quickly, objectively, and fairly against the role's core requirements. Our system identifies the top-fitting candidates, and this shortlist is then shared directly with the hiring company. The final decision and next steps (interviews, assessments) are managed by their internal team.
We appreciate your interest and wish you the best!
Why Apply Through Jobgether?
Data Privacy Notice: By submitting your application, you acknowledge that Jobgether will process your personal data to evaluate your candidacy and share relevant information with the hiring employer. This processing is based on legitimate interest and pre-contractual measures under applicable data protection laws (including GDPR). You may exercise your rights (access, rectification, erasure, objection) at any time.
We may use artificial intelligence (AI) tools to support parts of the hiring process, such as reviewing applications, analyzing resumes, or assessing responses and identifying potential inconsistencies or verification signals in application materials based on available information. These tools assist our recruitment team but do not replace human judgment. Final hiring decisions are ultimately made by humans. If you would like more information about how your data is processed, please contact us.
المصدر: LinkedIn - أُضيفت للموقع في 19 أكتوبر 2026
رقم الإعلان لدى المصدر: 4479965535
رقم الإعلان لدى المصدر: 4479965535