{"id":3328256,"url":"https://alion.io/job/aspire-application-security-engineer","title":"Application Security Engineer","company":{"id":4434949,"name":"Aspire","domain":"aspire.jo","url":"https://alion.io/company/aspire-4","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Zoho Recruit","truth_index":null},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"inferred_company_offices","remote_working_hours":null,"hiring_geo_confidence":"inferred","locations":[],"countries":[],"hiring_countries":["JO"],"hiring_countries_total":1,"salary":null,"salary_estimate":{"min_usd":100000,"max_usd":206000,"period":"year","method":"global_role_seniority_cell","sample_n":2372},"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Amazon S3","optional":false},{"name":"API Gateway","optional":false},{"name":"AWS","optional":false},{"name":"AWS Lambda","optional":false},{"name":"AWS WAF","optional":false},{"name":"Burp Suite","optional":false},{"name":"CI/CD","optional":false},{"name":"Go","optional":false},{"name":"GraphQL","optional":false},{"name":"IAM","optional":false},{"name":"JavaScript","optional":false},{"name":"OWASP","optional":false},{"name":"OWASP Top 10","optional":false},{"name":"Python","optional":false},{"name":"Qualys Cloud Platform","optional":false},{"name":"Rest API","optional":false},{"name":"Snyk","optional":false},{"name":"SonarQube","optional":false},{"name":"Threat Modeling","optional":false},{"name":"TypeScript","optional":false},{"name":"Wiz","optional":false}],"status":"live","first_seen_at":"2026-10-27T11:09:30Z","employer_posted_date":"2026-10-27","last_verified_at":"2026-10-31T22:50:25Z","board_verified":true,"closed_at":null,"days_open":4,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":4},"description":"This is a remote position.\nAbout the Job\nAs anApplication Security Engineer at Aspire, you will play a key role in identifying, validating, and remediating application and API vulnerabilities across our digital platforms. You will investigate findings from security assessment tools such as Wiz, Qualys, Snyk, and SonarQube, manually validate potential exploits, assess business impact, and collaborate closely with development teams to implement effective security fixes.\nYou will lead application security testing initiatives, manage SAST and DAST programs, conduct secure code reviews, and evaluate how AWS configurations impact application security. Working in a hands-on, security-focused environment, you will help reduce security risks, improve secure development practices, and ensure vulnerabilities are accurately prioritized and remediated. You will also contribute to threat modeling, security automation, and continuous improvement of application security processes.\nWhat you'll do \nTriage and validate security findings from Wiz, Qualys, and automated or AI-driven penetration testing tools by reproducing exploits and identifying false positives.\nAssess vulnerabilities based on exploitability, business impact, data exposure, and overall risk, and track remediation through closure.\nProvide clear, actionable remediation guidance, including code-level recommendations, and review developer fixes to ensure vulnerabilities are fully resolved.\nIdentify recurring vulnerability patterns and recommend root-cause solutions, including shared authorization libraries, secure coding standards, and secure-by-default configurations.\nPerform manual security testing of web applications and APIs, focusing on authentication, authorization, BOLA/IDOR, privilege escalation, session management, injection, and business logic flaws.\nTest REST and GraphQL APIs to identify access control weaknesses, authorization bypasses, and other OWASP API Security Top 10 vulnerabilities.\nInvestigate shadow and undocumented APIs discovered by security tools and assess their exposure and associated risks.\nConduct secure code reviews and threat modeling for new application features, APIs, and integrations.\nManage and optimize SAST and DAST programs using Snyk, SonarQube, and Qualys Web Application Scanning (WAS), including custom rules, quality gates, scan configurations, and false-positive reduction.\nConfigure and maintain authenticated DAST scans against web applications and APIs, ensuring meaningful coverage of application functionality and security controls.\nCorrelate findings from Snyk, SonarQube, Qualys, and Wiz to identify vulnerabilities present in source code and exploitable in production environments.\nIntegrate security testing into development workflows and CI/CD pipelines, establishing appropriate severity thresholds and security quality gates.\nAssess AWS configurations affecting application security, including IAM roles and policies, S3 bucket exposure, API Gateway, Lambda permissions, and secrets management.\nValidate cloud-to-application attack paths identified by Wiz, including scenarios where vulnerable applications operate with excessive AWS permissions.\nReview AWS WAF rules and recommend protective measures against identified application vulnerabilities and attack patterns.\nUse AWS Security Hub, GuardDuty, and Inspector findings to support vulnerability investigations, risk prioritization, and remediation efforts.\nTrack vulnerability trends, remediation SLAs, and application security posture, providing clear reports and recommendations to engineering and security leadership.\nCollaborate with development, cloud, and security teams to strengthen application security practices and continuously improve vulnerability management processes.\nWhat you'll need\nBachelor’s degree in Information Security, Computer Science, Software Engineering, or a related field, or equivalent practical experience.\n5+ years of hands-on experience in application security, penetration testing, or vulnerability research.\nProven experience identifying and exploiting business logic flaws and access control vulnerabilities in REST and GraphQL APIs.\nDeep understanding of the OWASP Top 10 and OWASP API Security Top 10, including authentication, authorization, injection, and business logic vulnerabilities.\nStrong proficiency with manual application security testing tools, particularly Burp Suite Professional, including request manipulation and custom test case development.\nHands-on experience operating, configuring, and tuning SAST and DAST tools such as Snyk, SonarQube, and Qualys, including vulnerability triage and false-positive reduction.\nAbility to read, analyze, and review application code in at least one modern programming language, such as Python, Java, Go, or JavaScript/TypeScript.\nWorking knowledge of AWS security services and configurations, particularly IAM, S3, Lambda, and API Gateway, and their impact on application security\nExperience with Wiz, Qualys, or comparable cloud security posture management (CNAPP) and vulnerability management platforms, with the ability to turn automated scan results into validated, prioritized security findings.\nExperience integrating security testing into development workflows and collaborating with developers to implement secure coding practices.\nStrong understanding of vulnerability assessment, exploit validation, risk-based prioritization, and remediation lifecycle management.\nExcellent analytical and problem-solving skills, with the ability to distinguish exploitable vulnerabilities from scanner noise.\nHands-on experience with SOAR platforms, including building playbooks and integrations to automate vulnerability management workflows.\nExperience with automated or AI-assisted penetration testing and continuous DAST platforms.\nExperience developing custom security rules and quality profiles in SonarQube or Snyk.\nAWS Certified Security - Specialty certification.\nOffensive security certifications such as OSCP, OSWE, BSCP, or GWAPT.\nParticipation in bug bounty programs or experience publishing vulnerability research.\nStrong written and verbal communication skills, particularly in preparing developer-focused remediation guidance and security reports for leadership.\nAbility to influence development teams, drive remediation without direct authority, and work independently in a fast-paced, remote environment.\nAwarenessorknowledgeofITsecuritybestpracticesasdefinedbyISO/SOCor similar.\nWhy Aspire:\nIn addition to a competitive long-term total compensation package with salary and performance-basedbonus,wehavearewardphilosophythatgoesbeyondcompensation.\nBepartofaremote-firstorganizationwhereflexibilityisembraced.\nWorkandlearnalongsidetalentedengineersandtechnologyleaders.\nExploreopportunitiestolearnandgrowthroughtechnicalandnon-technicaltraining programs.\nGainglobalexposurebyworkingonproductswithinternationalteamsandclients.\nAttendvirtualandin-personinternationaltechnologyconferencestoexpandyour knowledge and network.\nExposuretoworkinginanITenvironmentthatadherestorigoroussecurityand compliance standards defined by ISO / SOC.","description_format":"text","description_chars":7127,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"Jordan","iso":"JO","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Application Security"],"lifecycle":[{"event":"open","at":"2026-10-27T11:09:30Z"}],"visa":[],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":3,"expected_fill_days":29,"reasons":["conf:1","velocity","win:early"],"computed_at":"2026-10-31T05:58:55Z"},"pay":null,"html_url":"https://alion.io/job/aspire-application-security-engineer","json_url":"https://alion.io/job/aspire-application-security-engineer.json","meta":{"generated_at":"2026-10-31T23:03:55Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":35977,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-01T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":4434949},"rest":"https://alion.io/mcp/rest/get_company?id=4434949"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Faspire-application-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Faspire-application-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Faspire-application-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/aspire-application-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Faspire-application-security-engineer"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3328256}},{"tool":"search_jobs","arguments":{"company":"aspire.jo","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3328256},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}