About

M. Asif Masood

Senior Application Security Engineer

Application Security Engineer with ~4 years of experience securing telecom, fintech, and streaming platforms in Pakistan and Iraq. Hands-on across VAPT, threat modeling, secure code review, and DevSecOps in CI/CD. Focused on finding real issues, explaining them clearly, and helping engineers fix them.

01 Experience

  1. Asiacell Communications PJSC Ooredoo Group

    2026 – Present

    Senior Application Security Engineer

    Iraq
    • Perform penetration testing, application security assessments, secure code review (Java, .NET), and threat modeling (DREAD scoring) across web, mobile, and API platforms for Iraq’s largest telecom company (16M+ subscribers, part of Ooredoo Group), working with engineering teams to fix risks before release.
    • Secure a broad product portfolio, including AsiaPay (fintech/wallet), AsiaMall (one of Iraq’s largest e-commerce platforms), the Asiacell self-care app, B2B apps, and core telecom systems and APIs.
    • Embed SAST, DAST, and SCA checks in CI/CD pipelines as part of the company’s AppSec and DevSecOps program.
    • Drive secure-by-design practices by reviewing architecture and requirements early, so security is built into new products rather than added after launch.
    • Introduced on-prem, LLM-assisted secure code review that cut SAST false positives by ~95%.

  2. Jazz (PMCL) · JazzWorld VEON Group

    2022 – 2026

    Application Security Engineer II

    Pakistan

    Progressed from Intern → Engineer I → Engineer II over 3.5 years

    • Worked on application security for Pakistan’s largest digital and telecom company (70M+ subscribers), covering the Simosa super-app, JazzCash (the country’s largest mobile wallet and fintech app), ROX, and Tamasha OTT.
    • Application security lead for JazzCash (fintech/wallet) and Simosa (self-care app): ran pre-release security reviews and vendor assessments, drove fixes with development teams, and advised engineers on authentication, authorization, and API design.
    • Operationalized a scalable application security program, integrating SAST, DAST, and SCA across the company’s microservice repositories.
    • Ran application security assessments and penetration testing across web, mobile, and APIs, getting critical issues fixed before release.
    • Led threat modeling, secure code reviews (Node.js, Java, Python), and VAPT early in the SDLC across telecom systems, banking and payments, streaming, and B2B products, working with development, product, security operations, and governance teams.
    • Built and ran the team’s central AppSec reporting and remediation-tracking workflow across 50+ internal, external, and flagship applications, cutting report turnaround from several days to one.

  3. National Center for Cyber Security · NCCS

    2022

    Security Researcher

    Pakistan
    • Web application penetration testing; built an automation framework for detecting common web vulnerabilities.

02 Education

  • BS, CybersecurityAir University

03 Certifications

  • eWPTX Web App Pen Tester eXtreme2026INE
  • eMAPT Mobile App Pen Tester2026INE
  • eJPT Penetration Tester2023INE

04 Skills

Security
Application Security · VAPT · DevSecOps · API Security · Threat Modeling · Secure Code Review · Secure SDLC · OWASP Top 10
Tools
SAST, DAST, and SCA platforms · Vulnerability management (Tenable, Qualys) · Burp Suite · GitLab CI/CD

05 Highlights

  • Black Hat MEA CTF Finalist (2024 & 2025)
  • Part of the Jazz team ranked #1 in Pakistan’s PTA Telecom Cybersecurity Index (2023)