Application Security Engineer

{
  "content_hash": "f9e152d2ef7bfacfb5c8b0356fb4bdb95a263f5349b1e513465dca66905fa3a8",
  "source_hash": "61df9960084b4b505ad500557eef65b486cf284d64e8402d15d068209552ee5e",
  "last_changed_at": "2026-05-30T05:43:27.666Z",
  "active_status": "active"
}

{
  "language": "en",
  "location": {
    "raw": "CAIRO, 29432, Egypt",
    "city": "CAIRO",
    "region": null,
    "country": null,
    "is_remote": false,
    "confidence": 0.8
  },
  "salary_max": null,
  "salary_min": null,
  "inferred_at": "2026-06-06T10:28:09.317Z",
  "launch_scope": {
    "reason": "bamboohr_production_catalog",
    "included": true,
    "location": {
      "raw": "CAIRO, 29432, Egypt",
      "city": "CAIRO",
      "region": null,
      "country": null,
      "is_remote": false,
      "confidence": 0.8
    },
    "countries": []
  },
  "remote_policy": null,
  "salary_period": null,
  "workplace_type": null,
  "salary_currency": null
}

{}

{
  "list_job": {
    "id": "122",
    "isRemote": null,
    "location": {
      "city": "CAIRO",
      "state": null
    },
    "atsLocation": {
      "city": null,
      "state": null,
      "country": null,
      "province": null
    },
    "departmentId": "18581",
    "locationType": "2",
    "jobOpeningName": "Application Security Engineer",
    "departmentLabel": "Security",
    "employmentStatusLabel": "Full-Time"
  },
  "detail_errors": [],
  "detail_job_opening": {
    "location": {
      "city": "CAIRO",
      "state": null,
      "postalCode": "29432",
      "addressCountry": "Egypt"
    },
    "datePosted": "2026-05-03",
    "atsLocation": {
      "city": null,
      "state": null,
      "country": null,
      "countryId": null
    },
    "description": "<p><span style=\"font-family: Arial, sans-serif; font-size: 14pt; font-weight: bold\">Job Purpose<br><br></span></p>\n<p><span style=\"font-family: Arial, sans-serif; font-size: 10pt\">As an Application Security Engineer at Luciq, you will help shape and build our application security program alongside the wider team. This is a hands-on, high-ownership role where you will work closely with product and development teams across the full software development lifecycle — reviewing designs before code is written, identifying risks as features take shape, and ensuring security is embedded into how we build and ship software, not bolted on after the fact. Our stack runs on Ruby on Rails, Go, and Python, deployed on AWS with Terraform managing infrastructure as code and Jenkins powering CI/CD. You will read and review code in these languages — not just rely on scanner output — and work with AWS security services (SecurityHub, Inspector, GuardDuty, CloudTrail, CloudFront) to provide visibility and protection across our infrastructure. The role spans web applications, APIs, our mobile SDK (iOS and Android), cloud, and CI/CD — partnering with engineers, PMs, Platform, and the Security team to make the secure path the default path. This role can be filled at mid-level with a clear growth path to senior-level as you grow into shaping our application security program, or at senior-level if you're already operating at that scope.</span></p>\n<p><span style=\"font-family: Arial, sans-serif; font-size: 10pt\">You will join a lean Security team, which entails stepping beyond core AppSec for incident triage, addressing customer security questionnaires, or supporting cross-functional cloud and compliance reviews. We value this variety as a core facet of the role; if you are seeking hyper-specialized work restricted strictly to application security, this may not be the right fit.</span></p>\n<p><br></p>\n<p><br></p>\n<p><span style=\"font-family: Arial, sans-serif; font-size: 14pt\">Job Responsibilities</span></p>\n<ul>\n<li><span style=\"font-family: Arial, sans-serif; font-size: 10pt; font-weight: bold\">Secure Design &amp; Code Review</span></li>\n</ul>\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li><span style=\"font-family: Arial, sans-serif; font-size: 10pt\">Run and lead threat modeling sessions with product and engineering teams during feature design. This is a hands-on role with expectations to deliver fixes in the product as needed while enabling other engineers.</span></li>\n<li><span style=\"font-family: Arial, sans-serif; font-size: 10pt\">Conduct security code reviews and architecture reviews across web applications, APIs, and services in Ruby, Go, and Python</span></li>\n<li><span style=\"font-family: Arial, sans-serif; font-size: 10pt\">Leverage AI and make sure that we enable engineers to adhere to security acceptance criteria. Provide guidance to engineers on secure design as we iterate and build the product.</span></li>\n</ul>\n</li>\n</ul>\n<ul>\n<li><span style=\"font-family: Arial, sans-serif; font-size: 10pt; font-weight: bold\">Vulnerability Management</span></li>\n</ul>\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li><span style=\"font-family: Arial, sans-serif; font-size: 10pt\">Validate, triage, and drive remediation of vulnerabilities — partner with engineering teams across the full lifecycle from discovery through SLA support</span></li>\n<li><span style=\"font-family: Arial, sans-serif; font-size: 10pt\">Coordinate with engineering teams on fix verification and root-cause prevention</span></li>\n</ul>\n</li>\n</ul>\n<ul>\n<li><span style=\"font-family: Arial, sans-serif; font-size: 10pt; font-weight: bold\">Security Automation in CI/CD</span></li>\n</ul>\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li><span style=\"font-family: Arial, sans-serif; font-size: 10pt\">Build and maintain automated security testing in CI/CD — SAST, SCA, secret scanning</span></li>\n<li><span style=\"font-family: Arial, sans-serif; font-size: 10pt\">Tune tooling for signal over noise; integrate findings into developer workflows</span></li>\n<li><span style=\"font-family: Arial, sans-serif; font-size: 10pt\">Operate secret-scanning and leaked-credential response workflows</span></li>\n</ul>\n</li>\n</ul>\n<ul>\n<li><span style=\"font-family: Arial, sans-serif; font-size: 10pt; font-weight: bold\">Cloud &amp; Infrastructure Security</span></li>\n</ul>\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li><span style=\"font-family: Arial, sans-serif; font-size: 10pt\">Support cloud security reviews — IAM policies, network segmentation, container/Kubernetes configurations, and Terraform policy-as-code</span></li>\n<li><span style=\"font-family: Arial, sans-serif; font-size: 10pt\">Work with AWS security services (SecurityHub, Inspector, GuardDuty, CloudTrail, CloudFront) to maintain visibility and detection across our infrastructure</span></li>\n</ul>\n</li>\n</ul>\n<ul>\n<li><span style=\"font-family: Arial, sans-serif; font-size: 10pt; font-weight: bold\">Supply Chain &amp; Build Security</span></li>\n</ul>\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li><span style=\"font-family: Arial, sans-serif; font-size: 10pt\">Own dependency risk via SCA, lockfiles, and pinning</span></li>\n<li><span style=\"font-family: Arial, sans-serif; font-size: 10pt\">Drive CI/CD pipeline hardening — build runners, OIDC-to-cloud, artifact signing, SBOM standards</span></li>\n</ul>\n</li>\n</ul>\n<ul>\n<li><span style=\"font-family: Arial, sans-serif; font-size: 10pt; font-weight: bold\">Cross-functional Security Enablement</span></li>\n</ul>\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li><span style=\"font-family: Arial, sans-serif; font-size: 10pt\">Develop secure coding guidelines and reusable patterns that make the secure path the default</span></li>\n<li><span style=\"font-family: Arial, sans-serif; font-size: 10pt\">Drive S-SDLC adoption across engineering teams</span></li>\n<li><span style=\"font-family: Arial, sans-serif; font-size: 10pt\">Review security posture of our mobile SDK across iOS and Android — data handling, transport security, local storage, IPC, encryption, third-party dependency risk, and SDK consumer-facing security defaults</span></li>\n<li><span style=\"font-family: Arial, sans-serif; font-size: 10pt\">Assess security risks in AI/LLM integrations — prompt injection, insecure output handling, trust boundaries in agentic architectures</span></li>\n<li><span style=\"font-family: Arial, sans-serif; font-size: 10pt\">Support compliance initiatives (SOC 2, ISO 27001) — translate control requirements into engineering practices and assist with audit evidence collection</span></li>\n<li><span style=\"font-family: Arial, sans-serif; font-size: 10pt\">Use AI tooling actively in your own workflow AI-assisted code review, threat modeling drafts, vulnerability research, and security artifact generation  and help shape how the rest of engineering uses AI safely</span></li>\n</ul>\n</li>\n</ul>\n<p><br></p>\n<p><br></p>\n<p><span style=\"font-family: Arial, sans-serif; font-size: 14pt; font-weight: bold\">Job Requirements</span></p>\n<p><br></p>\n<p><span style=\"color: rgb(67, 67, 67); font-family: Arial, sans-serif; font-size: 14pt; font-weight: bold\">Must-Haves</span></p>\n<ul>\n<li><span style=\"font-family: Arial, sans-serif; font-size: 10pt; font-weight: bold\">Experience</span><span style=\"font-family: Arial, sans-serif; font-size: 10pt\">: 3-6 years in application security, or security engineering</span></li>\n<li><span style=\"font-family: Arial, sans-serif; font-size: 10pt; font-weight: bold\">Education</span><span style=\"font-family: Arial, sans-serif; font-size: 10pt\">: Bachelor's degree in Computer Science, Information Security, or equivalent practical experience</span></li>\n<li><span style=\"font-family: Arial, sans-serif; font-size: 10pt; font-weight: bold\">Secure code review</span><span style=\"font-family: Arial, sans-serif; font-size: 10pt\"> in at least one of: Python, Ruby, Go — can read code and reason about vulnerabilities, not rely on scanner output</span></li>\n<li><span style=\"font-family: Arial, sans-serif; font-size: 10pt; font-weight: bold\">OWASP Top 10 (Web and API)</span><span style=\"font-family: Arial, sans-serif; font-size: 10pt\"> as root-cause patterns, not a memorized checklist — including SSRF, insecure deserialization, injection classes, and access-control flaws</span></li>\n<li><span style=\"font-family: Arial, sans-serif; font-size: 10pt; font-weight: bold\">Threat modeling</span><span style=\"font-family: Arial, sans-serif; font-size: 10pt\">: practical experience with STRIDE and data flow diagrams; can lead a session with a product team and produce actionable output</span></li>\n<li><span style=\"font-family: Arial, sans-serif; font-size: 10pt; font-weight: bold\">Auth and identity</span><span style=\"font-family: Arial, sans-serif; font-size: 10pt\">: working depth in session management, RBAC/ABAC models</span></li>\n<li><span style=\"font-family: Arial, sans-serif; font-size: 10pt; font-weight: bold\">CI/CD security automation</span><span style=\"font-family: Arial, sans-serif; font-size: 10pt\">: hands-on experience integrating SAST, SCA, and secret scanning into pipelines and tuning for actionable signal</span></li>\n<li><span style=\"font-family: Arial, sans-serif; font-size: 10pt; font-weight: bold\">Proactive and ownership-driven</span><span style=\"font-family: Arial, sans-serif; font-size: 10pt\"> — does not wait to be told what to secure</span></li>\n<li><span style=\"font-family: Arial, sans-serif; font-size: 10pt\">Comfortable working </span><span style=\"font-family: Arial, sans-serif; font-size: 10pt; font-weight: bold\">cross-functionally</span><span style=\"font-family: Arial, sans-serif; font-size: 10pt\"> with product engineers, platform engineers, and the wider team</span></li>\n<li><span style=\"font-family: Arial, sans-serif; font-size: 10pt\">Strong </span><span style=\"font-family: Arial, sans-serif; font-size: 10pt; font-weight: bold\">analytical and problem-solving</span><span style=\"font-family: Arial, sans-serif; font-size: 10pt\"> abilities</span></li>\n<li><span style=\"font-family: Arial, sans-serif; font-size: 10pt\">Fluent in </span><span style=\"font-family: Arial, sans-serif; font-size: 10pt; font-weight: bold\">English</span><span style=\"font-family: Arial, sans-serif; font-size: 10pt\">, with strong written and verbal communication</span><br></li>\n<li><span style=\"font-family: Arial, sans-serif; font-size: 10pt; font-weight: bold\">Communication</span><span style=\"font-family: Arial, sans-serif; font-size: 10pt\">: clear written and verbal communication can explain a vulnerability to an engineer, a PM, or a VP<br><br></span></li>\n</ul>\n<p><span style=\"color: rgb(67, 67, 67); font-family: Arial, sans-serif; font-size: 14pt; font-weight: bold\">Strong Plus</span></p>\n<p><span style=\"font-family: Arial, sans-serif; font-size: 10pt\">We expect strong candidates to have </span><span style=\"font-family: Arial, sans-serif; font-size: 10pt; font-style: italic\">some</span><span style=\"font-family: Arial, sans-serif; font-size: 10pt\"> of these not all. The more, the better.</span></p>\n<ul>\n<li><span style=\"font-family: Arial, sans-serif; font-size: 10pt; font-weight: bold\">Mobile SDK security</span><span style=\"font-family: Arial, sans-serif; font-size: 10pt\">: OWASP Mobile Top 10 and MASVS/MASTG; Android (Kotlin) or iOS (Swift); experience with Frida, objection, or MobSF</span></li>\n<li><span style=\"font-family: Arial, sans-serif; font-size: 10pt; font-weight: bold\">AWS security service depth</span><span style=\"font-family: Arial, sans-serif; font-size: 10pt\">: SecurityHub, Inspector, GuardDuty, CloudTrail, CloudFront beyond IAM</span></li>\n<li><span style=\"font-family: Arial, sans-serif; font-size: 10pt; font-weight: bold\">Container and Kubernetes</span><span style=\"font-family: Arial, sans-serif; font-size: 10pt\"> security fundamentals</span></li>\n<li><span style=\"font-family: Arial, sans-serif; font-size: 10pt; font-weight: bold\">Supply chain depth</span><span style=\"font-family: Arial, sans-serif; font-size: 10pt\">: SLSA framework, SBOM</span><span style=\"font-family: Arial, sans-serif; font-size: 10pt; font-weight: bold\">AI/LLM security</span><span style=\"font-family: Arial, sans-serif; font-size: 10pt\">: prompt injection mitigations, OWASP LLM Top 10, securing agentic architectures and tool-use boundaries</span></li>\n<li><span style=\"font-family: Arial, sans-serif; font-size: 10pt\">Familiarity with </span><span style=\"font-family: Arial, sans-serif; font-size: 10pt; font-weight: bold\">ISO 27001 or SOC 2</span><span style=\"font-family: Arial, sans-serif; font-size: 10pt\">.<br><br></span></li>\n</ul>\n<p><span style=\"color: rgb(67, 67, 67); font-family: Arial, sans-serif; font-size: 14pt; font-weight: bold\">Nice to Have</span></p>\n<ul>\n<li><span style=\"font-family: Arial, sans-serif; font-size: 10pt\">Terraform and policy-as-code: tfsec, Checkov, OPA/Conftest</span></li>\n<li><span style=\"font-family: Arial, sans-serif; font-size: 10pt\">Experience building or bootstrapping a security program</span></li>\n<li><span style=\"font-family: Arial, sans-serif; font-size: 10pt\">Bug bounty participation, published CVEs, or documented security research</span></li>\n<li><span style=\"font-family: Arial, sans-serif; font-size: 10pt\">Hands-on certifications: OSCP, OSWE, eMAPT</span></li>\n<li><span style=\"font-family: Arial, sans-serif; font-size: 10pt\">Incident response experience — triage, containment, root-cause analysis</span></li>\n<li><span style=\"font-family: Arial, sans-serif; font-size: 10pt\">Red teaming or purple teaming experience</span></li>\n</ul>",
    "compensation": null,
    "departmentId": "18581",
    "locationType": "2",
    "seekPromoted": false,
    "jobCategoryId": null,
    "jobOpeningName": "Application Security Engineer",
    "departmentLabel": "Security",
    "jobOpeningStatus": "Open",
    "minimumExperience": "Mid-level",
    "jobOpeningShareUrl": "https://instabug.bamboohr.com/careers/122",
    "employmentStatusLabel": "Full-Time"
  }
}