Application Security Engineer

About the role

Siren is looking for an Application Security Engineer in Beirut to assess and strengthen the security of applications developed and maintained by its team. The role covers penetration testing, vulnerability assessment and remediation guidance, working closely with Development, QA and DevOps teams.

Key responsibilities

• Plan and carry out manual and automated penetration testing of web, API and mobile applications
• Evaluate authentication, authorization, session management, input validation, business logic and sensitive data protection
• Analyse vulnerability scanner results, filter false positives and document reproducible evidence
• Prioritise findings by severity, exploitability and business impact, and escalate critical issues
• Work with developers to fix root causes, retest before closure and maintain a vulnerability register
• Conduct targeted security code reviews, support secure design reviews and pipeline security checks
• Write security reports, management summaries and practical secure coding guidance

Required profile

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology or a related field, or equivalent practical experience
• 5+ years of hands-on application security or penetration testing experience, including web apps and APIs
• Ability to review code in at least one programming language and write basic test or automation scripts
• Experience guiding developers through remediation and managing assessments independently
• Relevant certifications such as OSCP or OSWE are an advantage

Required skills

• Strong knowledge of common application vulnerabilities and OWASP testing practices
• Manual security testing beyond automated scanning, with tools such as Burp Suite, OWASP ZAP and vulnerability scanners
• HTTP/HTTPS, REST APIs, authentication, access controls, SQL and application configuration
• CI/CD security tools, dependency scanning and secret detection
• Mobile security testing, threat modeling and secure design reviews
• On-premises or restricted environments and handling sensitive information