Qureos Mentor

Practical DevSecOps

Practical DevSecOps is a global cybersecurity education company that specializes in hands-on training and certification programs in DevSecOps, AI Security, and Application Security. With a focus on practical skills, the company has trained over 12,500 security professionals across more than 108 countries. Their programs are designed for practitioners and include various certifications such as Certified DevSecOps Professional and Certified AI Security Professional. Trusted by major organizations, Practical DevSecOps aims to enhance cybersecurity capabilities worldwide.

<div>
 
 Role Overview
 
 
 
 We are seeking a highly skilled Application Security Engineer with 6&ndash;8 years of experience to drive secure software
 
 
 development, cloud security, and application security initiatives across enterprise environments.
 
 
 The ideal candidate will possess strong hands-on expertise in Microsoft Azure, Azure DevOps, Secure SDLC, Threat
 
 
 Modeling, Vulnerability Assessment &amp; Penetration Testing (VAPT), Cloud Security, and Secure Application
 
 
 Architecture. This role requires deep technical involvement in integrating security throughout the software
 
 
 development lifecycle while supporting secure cloud adoption and compliance with organizational security
 
 
 requirements.
 
 
 This position is approximately 80% hands-on technical execution and 20% governance, standards, and security
 
 
 advisory activities.
 
 
 
 Key Responsibilities
 
 
 
 DevSecOps &amp; Secure SDLC
 
 
 <ul>
 <li>
 Design, implement, and maintain secure CI/CD pipelines using Azure DevOps.
 </li>
 <li>
 Integrate security controls into all phases of the software development lifecycle.
 </li>
 <li>
 Embed DevSecOps practices across development, testing, deployment, and operational processes.
 </li>
 <li>
 Automate security testing and validation activities within CI/CD pipelines.
 </li>
 <li>
 Establish secure coding standards, security gates, and release controls.
 </li>
 <li>
 Collaborate with development teams to remediate security vulnerabilities and improve security posture.
 </li>
 <li>
 Develop reusable security controls, templates, and secure development frameworks.
 
 
 </li>
 </ul>
 Application Security
 
 
 <ul>
 <li>
 Conduct secure code reviews for .NET, C#, Python, JavaScript, React, Angular, Node.js, and related technologies.
 </li>
 <li>
 Perform application security assessments against web applications, APIs, microservices, and cloud-native workloads.
 </li>
 <li>
 Identify security weaknesses and provide remediation guidance.
 </li>
 <li>
 Validate remediation activities and verify closure of identified vulnerabilities.
 </li>
 <li>
 Provide technical consultation on secure application architecture and design.
 
 
 </li>
 </ul>
 
 Vulnerability Assessment &amp; Penetration Testing (VAPT)
 
 
 
 <ul>
 <li>
 Perform hands-on vulnerability assessments and penetration testing for:
 </li>
 <li>
 Web applications
 </li>
 <li>
 APIs
 </li>
 <li>
 Mobile- iOS and Androido Cloud-hosted applications
 </li>
 <li>
 Azure environments
 </li>
 <li>
 SAST &amp; DAST
 </li>
 <li>
 Secure Code Review
 </li>
 <li>
 Containers and Kubernetes platforms
 </li>
 <li>
 Conduct authenticated and unauthenticated security assessments.
 </li>
 <li>
 Execute manual validation of automated scan findings.
 </li>
 <li>
 Analyze and prioritize vulnerabilities based on business and technical risk.
 </li>
 <li>
 Support remediation efforts and perform retesting activities.
 </li>
 <li>
 Maintain awareness of emerging attack techniques and security threats.
 
 
 </li>
 </ul>
 
 Threat Modeling &amp; Secure Design
 
 
 
 <ul>
 <li>
 Independently conduct threat modeling exercises using STRIDE and industry-recognized methodologies.
 </li>
 <li>
 Develop and maintain threat libraries, attack trees, misuse cases, and secure design patterns.
 </li>
 <li>
 Facilitate threat modeling workshops with architects, developers, and project teams.
 </li>
 <li>
 Identify architectural security risks and recommend mitigation strategies.
 </li>
 <li>
 Review application and cloud solution designs from a security perspective.
 
 
 </li>
 </ul>
 
 Cloud Security Engineering (Azure)
 
 
 
 <ul>
 <li>
 Design and implement security controls for Microsoft Azure environments.
 </li>
 <li>
 Secure Azure-native services including:
 </li>
 <li>
 Azure App Services
 </li>
 <li>
 Azure Kubernetes Service (AKS)
 </li>
 <li>
 Azure Storage
 </li>
 <li>
 Azure Key Vault
 </li>
 <li>
 Azure API Management
 </li>
 <li>
 Azure Functions
 </li>
 <li>
 Azure SQL Services
 </li>
 <li>
 Implement identity and access management controls using Microsoft Entra ID.
 </li>
 <li>
 Manage and optimize Microsoft Defender for Cloud, Defender for DevOps, Defender for Containers, and Defender XDR capabilities.
 </li>
 <li>
 Conduct Azure security reviews, architecture assessments, and configuration hardening activities.
 </li>
 <li>
 Implement security monitoring, alerting, and cloud security best practices.
 
 
 </li>
 </ul>
 
 Container &amp; Kubernetes Security
 
 
 
 <ul>
 <li>
 Secure containerized applications throughout the development lifecycle.
 </li>
 <li>
 Implement container image scanning and vulnerability management processes.
 </li>
 <li>
 Harden Kubernetes and AKS environments.
 </li>
 <li>
 Secure Kubernetes workloads, secrets management, ingress configurations, RBAC controls, and network policies.
 </li>
 <li>
 Implement runtime protection and container security monitoring capabilities.Technical Risk Assessments
 </li>
 <li>
 Perform application security risk assessments.
 </li>
 <li>
 Perform cloud security risk assessments.
 </li>
 <li>
 Perform infrastructure security assessments.
 </li>
 <li>
 Conduct technical security reviews for new projects and technology implementations.
 </li>
 <li>
 Evaluate security risks and recommend mitigation strategies.
 </li>
 <li>
 Develop risk reports and communicate findings to technical and business stakeholders.
 
 
 </li>
 </ul>
 
 Security Governance &amp; Compliance
 
 
 
 <ul>
 <li>
 Support compliance initiatives related to:
 </li>
 <li>
 NCA Essential Cybersecurity Controls (ECC)
 </li>
 <li>
 NCA Cloud Cybersecurity Controls (CCC)
 </li>
 <li>
 ISO 27001
 </li>
 <li>
 CIS Benchmarks
 </li>
 <li>
 Saudi Personal Data Protection Law (PDPL)
 </li>
 <li>
 Translate compliance requirements into technical security controls.
 </li>
 <li>
 Support security audits, assessments, and remediation activities.
 
 
 </li>
 </ul>
 
 Required Technical Exposure &amp; Skills
 
 
 
 
 DevSecOps &amp; Automation
 
 
 
 <ul>
 <li>
 Azure DevOps
 </li>
 <li>
 CI/CD Pipeline Design and Security
 </li>
 <li>
 Infrastructure as Code (Terraform, ARM, Bicep)
 </li>
 <li>
 Git and GitOps methodologies
 </li>
 <li>
 PowerShell, Python, and Bash scripting
 </li>
 <li>
 Secure release management practices
 
 
 </li>
 </ul>
 
 Application Security
 
 
 
 <ul>
 <li>
 Secure SDLC
 </li>
 <li>
 OWASP Top 10
 </li>
 <li>
 OWASP API Security Top 10
 </li>
 <li>
 Secure Coding Practices
 </li>
 <li>
 Threat Modeling
 </li>
 <li>
 STRIDE Methodology
 </li>
 <li>
 Security Architecture Reviews
 </li>
 <li>
 Source Code Security Reviews
 
 
 </li>
 </ul>
 
 Security Testing
 
 
 
 <ul>
 <li>
 Vulnerability Assessment
 </li>
 <li>
 Penetration Testing
 </li>
 <li>
 Web Application Security Testing
 </li>
 <li>
 API Security Testing
 </li>
 <li>
 Cloud Security Assessments
 </li>
 <li>
 Manual Security Testing Techniques
 </li>
 <li>
 Mobile Pentesting-iOS &amp; Android
 
 
 </li>
 </ul>
 
 Security Tools
 
 
 
 
 Experience With Six Or More Of The Following
 
 
 
 <ul>
 <li>
 Microsoft Defender for Cloud
 </li>
 <li>
 Microsoft Defender for DevOps
 </li>
 <li>
 Microsoft Defender XDR
 </li>
 <li>
 GitHub Advanced Security
 </li>
 <li>
 SonarQube
 </li>
 <li>
 Checkmarx
 </li>
 <li>
 Veracode
 </li>
 <li>
 Fortify
 </li>
 <li>
 Snyk
 </li>
 <li>
 OWASP ZAP
 </li>
 <li>
 Burp Suite Professional
 </li>
 <li>
 Trivy
 </li>
 <li>
 Prisma Cloud
 </li>
 <li>
 Aqua Security
 
 
 </li>
 </ul>
 
 Cloud &amp; Platform Security
 
 
 
 <ul>
 <li>
 Microsoft Azure Security Architecture
 </li>
 <li>
 Microsoft Entra ID
 </li>
 <li>
 Azure Key Vault
 </li>
 <li>
 Azure API Management
 </li>
 <li>
 Azure Kubernetes Service (AKS)
 </li>
 <li>
 Container Security
 </li>
 <li>
 Kubernetes Security Engineering
 </li>
 <li>
 Identity &amp; Access Management
 </li>
 <li>
 Secrets Management
 
 
 </li>
 </ul>
 
 Required Experience
 
 
 
 <ul>
 <li>
 6&ndash;8 years of experience in DevSecOps, Application Security, Cloud Security, or related cybersecurity
 
 
 </li>
 </ul>
 domains.
 
 
 <ul>
 <li>
 Minimum 4 years of hands-on Azure security experience.
 </li>
 <li>
 Proven experience implementing DevSecOps practices in enterprise environments.
 </li>
 <li>
 Demonstrated experience performing hands-on VAPT activities.
 </li>
 <li>
 Proven experience conducting STRIDE-based threat modeling exercises.
 </li>
 <li>
 Experience securing cloud-native and containerized applications.
 </li>
 <li>
 Experience supporting compliance and regulatory security requirements.
 </li>
 <li>
 Experience working in Agile and DevOps environments.
 
 
 </li>
 </ul>
 
 Preferred Certifications
 
 
 
 Three or more of the following certifications is highly desirable:
 
 
 <ul>
 <li>
 CISSP
 </li>
 <li>
 CCSP
 </li>
 <li>
 OSCP
 </li>
 <li>
 OSWE
 </li>
 <li>
 GWAPT
 </li>
 <li>
 CEH
 </li>
 <li>
 GIAC Cloud Security Certifications
 </li>
 <li>
 Kubernetes Security Specialist (CKS)
 </li>
 <li>
 Kubernetes Administrator (CKA)
 </li>
 <li>
 Azure Security certifications or equivalent practical experience
 
 
 </li>
 </ul>
 Equivalent demonstrable experience may be considered in lieu of certifications.
 
 
 
 Soft Skills
 
 
 
 <ul>
 <li>
 Strong analytical and problem-solving abilities.
 </li>
 <li>
 Excellent communication and stakeholder management skills.
 </li>
 <li>
 Ability to translate technical risks into business impact.
 </li>
 <li>
 Strong collaboration skills across development, operations, architecture, and security teams.
 </li>
 <li>
 Self-driven with a continuous learning mindset.
 </li>
 <li>
 Ability to work independently and lead security initiatives.
 </li>
 </ul>
</div>

Application Security Engineer

ROLE OVERVIEW: 
We are seeking a highly skilled Application Security Engineer with 6–8 years of experience to drive secure software
 development, cloud security, and application security initiatives across enterprise environments.
 The ideal candidate will possess strong hands-on expertise in Microsoft Azure, Azure DevOps, Secure SDLC, Threat
 Modeling, Vulnerability Assessment & Penetration Testing (VAPT), Cloud Security, and Secure Application
 Architecture. This role requires deep technical involvement in integrating security throughout the software
 development lifecycle while supporting secure cloud adoption and compliance with organizational security
 requirements.
 This position is approximately 80% hands-on technical execution and 20% governance, standards, and security
 advisory activities.
 
KEY RESPONSIBILITIES: 
DevSecOps & Secure SDLC
 <ul>
<li>Design, implement, and maintain secure CI/CD pipelines using Azure DevOps.</li>
<li>Integrate security controls into all phases of the software development lifecycle.</li>
<li>Embed DevSecOps practices across development, testing, deployment, and operational processes.</li>
<li>Automate security testing and validation activities within CI/CD pipelines.</li>
<li>Establish secure coding standards, security gates, and release controls.</li>
<li>Collaborate with development teams to remediate security vulnerabilities and improve security posture.</li>
<li>Develop reusable security controls, templates, and secure development frameworks.</li>
</ul>
Application Security
 <ul>
<li>Conduct secure code reviews for .NET, C#, Python, JavaScript, React, Angular, Node.js, and related technologies.</li>
<li>Perform application security assessments against web applications, APIs, microservices, and cloud-native workloads.</li>
<li>Identify security weaknesses and provide remediation guidance.</li>
<li>Validate remediation activities and verify closure of identified vulnerabilities.</li>
<li>Provide technical consultation on secure application architecture and design.</li>
</ul>
Vulnerability Assessment & Penetration Testing (VAPT)
 <ul>
<li>Perform hands-on vulnerability assessments and penetration testing for:</li>
</ul>
o Web applications
 o APIs
 o Mobile- iOS and Androido Cloud-hosted applications
 o Azure environments
 o SAST & DAST
 o Secure Code Review
 o Containers and Kubernetes platforms
 <ul>
<li>Conduct authenticated and unauthenticated security assessments.</li>
<li>Execute manual validation of automated scan findings.</li>
<li>Analyze and prioritize vulnerabilities based on business and technical risk.</li>
<li>Support remediation efforts and perform retesting activities.</li>
<li>Maintain awareness of emerging attack techniques and security threats.</li>
</ul>
Threat Modeling & Secure Design
 <ul>
<li>Independently conduct threat modeling exercises using STRIDE and industry-recognized methodologies.</li>
<li>Develop and maintain threat libraries, attack trees, misuse cases, and secure design patterns.</li>
<li>Facilitate threat modeling workshops with architects, developers, and project teams.</li>
<li>Identify architectural security risks and recommend mitigation strategies.</li>
<li>Review application and cloud solution designs from a security perspective.</li>
</ul>
Cloud Security Engineering (Azure)
 <ul>
<li>Design and implement security controls for Microsoft Azure environments.</li>
<li>Secure Azure-native services including:</li>
</ul>
o Azure App Services
 o Azure Kubernetes Service (AKS)
 o Azure Storage
 o Azure Key Vault
 o Azure API Management
 o Azure Functions
 o Azure SQL Services
 <ul>
<li>Implement identity and access management controls using Microsoft Entra ID.</li>
<li>Manage and optimize Microsoft Defender for Cloud, Defender for DevOps, Defender for Containers, and Defender XDR capabilities.</li>
<li>Conduct Azure security reviews, architecture assessments, and configuration hardening activities.</li>
<li>Implement security monitoring, alerting, and cloud security best practices.</li>
</ul>
Container & Kubernetes Security
 <ul>
<li>Secure containerized applications throughout the development lifecycle.</li>
<li>Implement container image scanning and vulnerability management processes.</li>
<li>Harden Kubernetes and AKS environments.</li>
<li>Secure Kubernetes workloads, secrets management, ingress configurations, RBAC controls, and network policies.</li>
<li>Implement runtime protection and container security monitoring capabilities.Technical Risk Assessments</li>
<li>Perform application security risk assessments.</li>
<li>Perform cloud security risk assessments.</li>
<li>Perform infrastructure security assessments.</li>
<li>Conduct technical security reviews for new projects and technology implementations.</li>
<li>Evaluate security risks and recommend mitigation strategies.</li>
<li>Develop risk reports and communicate findings to technical and business stakeholders.</li>
</ul>
Security Governance & Compliance
 <ul>
<li>Support compliance initiatives related to:</li>
</ul>
o NCA Essential Cybersecurity Controls (ECC)
 o NCA Cloud Cybersecurity Controls (CCC)
 o ISO 27001
 o CIS Benchmarks
 o Saudi Personal Data Protection Law (PDPL)
 <ul>
<li>Translate compliance requirements into technical security controls.</li>
<li>Support security audits, assessments, and remediation activities.</li>
</ul>
REQUIRED TECHNICAL EXPOSURE & SKILLS: 
DevSecOps & Automation
 <ul>
<li>Azure DevOps</li>
<li>CI/CD Pipeline Design and Security</li>
<li>Infrastructure as Code (Terraform, ARM, Bicep)</li>
<li>Git and GitOps methodologies</li>
<li>PowerShell, Python, and Bash scripting</li>
<li>Secure release management practices</li>
</ul>
Application Security
 <ul>
<li>Secure SDLC</li>
<li>OWASP Top 10</li>
<li>OWASP API Security Top 10</li>
<li>Secure Coding Practices</li>
<li>Threat Modeling</li>
<li>STRIDE Methodology</li>
<li>Security Architecture Reviews</li>
<li>Source Code Security Reviews</li>
</ul>
Security Testing
 <ul>
<li>Vulnerability Assessment</li>
<li>Penetration Testing</li>
<li>Web Application Security Testing</li>
<li>API Security Testing</li>
<li>Cloud Security Assessments</li>
<li>Manual Security Testing Techniques</li>
<li>Mobile Pentesting-iOS & Android</li>
</ul>
Security Tools
 
Experience with six or more of the following: 
<ul>
<li>Microsoft Defender for Cloud</li>
<li>Microsoft Defender for DevOps</li>
<li>Microsoft Defender XDR</li>
<li>GitHub Advanced Security</li>
<li>SonarQube</li>
<li>Checkmarx</li>
<li>Veracode</li>
<li>Fortify</li>
<li>Snyk</li>
<li>OWASP ZAP</li>
<li>Burp Suite Professional</li>
<li>Trivy</li>
<li>Prisma Cloud</li>
<li>Aqua Security</li>
</ul>
Cloud & Platform Security
 <ul>
<li>Microsoft Azure Security Architecture</li>
<li>Microsoft Entra ID</li>
<li>Azure Key Vault</li>
<li>Azure API Management</li>
<li>Azure Kubernetes Service (AKS)</li>
<li>Container Security</li>
<li>Kubernetes Security Engineering</li>
<li>Identity & Access Management</li>
<li>Secrets Management</li>
</ul>
REQUIRED EXPERIENCE
 <ul>
<li>6–8 years of experience in DevSecOps, Application Security, Cloud Security, or related cybersecurity</li>
</ul>
domains.
 <ul>
<li>Minimum 4 years of hands-on Azure security experience.</li>
<li>Proven experience implementing DevSecOps practices in enterprise environments.</li>
<li>Demonstrated experience performing hands-on VAPT activities.</li>
<li>Proven experience conducting STRIDE-based threat modeling exercises.</li>
<li>Experience securing cloud-native and containerized applications.</li>
<li>Experience supporting compliance and regulatory security requirements.</li>
<li>Experience working in Agile and DevOps environments.</li>
</ul>
PREFERRED CERTIFICATIONS
 Three or more of the following certifications is highly desirable:
 <ul>
<li>CISSP</li>
<li>CCSP</li>
<li>OSCP</li>
<li>OSWE</li>
<li>GWAPT</li>
<li>CEH</li>
<li>GIAC Cloud Security Certifications</li>
<li>Kubernetes Security Specialist (CKS)</li>
<li>Kubernetes Administrator (CKA)</li>
<li>Azure Security certifications or equivalent practical experience</li>
</ul>
Equivalent demonstrable experience may be considered in lieu of certifications.
 SOFT SKILLS
 <ul>
<li>Strong analytical and problem-solving abilities.</li>
<li>Excellent communication and stakeholder management skills.</li>
<li>Ability to translate technical risks into business impact.</li>
<li>Strong collaboration skills across development, operations, architecture, and security teams.</li>
<li>Self-driven with a continuous learning mindset.</li>
<li>Ability to work independently and lead security initiatives.</li>
</ul>

Join Practical DevSecOps and explore 2   exciting career opportunities. They're hiring for various roles with options for remote or on-site work. Apply today and become part of their innovative team.

Practical DevSecOps

About Company

Application Security Engineer

Application Security Engineer