Secure Source Code Reviewer (SAST Specialist)

Secure Source Code Reviewer (Sast Specialist)

Secure Source Code Reviewer (Sast Specialist)

The Role

Key Responsibilities

• Perform detailed manual secure code reviews across critical application components and APIs
• Review authentication and authorization mechanisms, cryptographic implementations, and sensitive data handling logic
• Validate and triage findings generated by SAST tools including Fortify SCA, Semgrep, CodeQL, and GitLab SAST
• Differentiate true positives from false positives and provide developers with clear remediation guidance
• Develop and maintain secure coding standards and framework-specific hardening guidance
• Support engineering teams through secure coding workshops and developer remediation sessions
• Collaborate with DevSecOps teams to improve SAST rule tuning, detection accuracy, and pipeline effectiveness
• Participate in application security architecture reviews and threat modelling exercises
• Contribute to improving the organisation’s secure development lifecycle maturity in alignment with NIST SSDF, ISO 27001, and OWASP SAMM

What We’re Looking For

• Minimum 3+ years of hands-on secure code review experience
• Strong knowledge of OWASP Top 10 and secure software development principles
• Deep technical expertise across:

• JavaScript And Node.js

• Python
• Go
• C#
• REST APIs and microservices architectures
• Keycloak
• Strong understanding of:
• Authentication and authorization flows
• Cryptography implementation and misuse
• API security vulnerabilities
• Secure design principles
• Experience using SAST platforms such as:
• Fortify SCA
• Semgrep
• CodeQL
• GitLab SAST
• Strong scripting and automation capability using Python, Bash, or PowerShell
• Familiarity with NIST CSF 2.0, ISO 27001, MITRE ATT&CK, and UAE IA Regulation
• Relevant security certifications such as OSCP, CISSP, GCIH, or CCSP are advantageous
• Excellent communication skills with the ability to work directly with both engineers and senior stakeholders

Key Objectives

• Improve the signal-to-noise ratio of SAST findings
• Reduce false positives across the secure development pipeline
• Ensure all critical-path modules undergo secure code review on a defined rotation
• Raise the overall secure coding maturity across engineering teams
• Identify design- and logic-level vulnerabilities missed by automated tooling
• Please apply to be contacted with further information.