Application Security Enablement Engineer

Position Responsibilities:

• Help drive adoption of enterprise application security standards across applications, platforms, and cloud environments
• Enable automation for vulnerability detection, remediation, exception review and reporting to improve efficiency and consistency.
• Provide actionable, risk-based technical guidance and training to developers on secure design and coding standards (e.g., OWASP).
• Partner with architects, product owners, and development teams during design and planning phases to embed secure-by-design principles.
• Conduct and validate application security testing (automated and manual), including intake and validation of findings from external penetration tests and bug bounty programs.

Accountabilities:

Individual Accountabilities:

• Support vulnerability management processes, including triage, exception review, remediation, and reporting.
• Conduct application and architecture-level Threat Modeling for new applications, major enhancements, and high-risk changes.
• Support uplift of Threat Modeling maturity by defining templates, playbooks, and reusable threat libraries for common platforms and patterns.
• Support to scale workstreams such as secrets, SCA, SAST, DAST vulnerability remediation.
• Partner with development teams to integrate security expectations into CI/CD pipelines and DevSecOps workflows.
• Validate and contextualize findings from automated tools, penetration tests, and external assessments where design-level issues are identified.

Key Shared Accountabilities:

• Partner with Global Application Security on standards, tooling and continuous improvement
• Collaborate with CIO, engineering, and architecture teams to ensure consistent adoption and accountability
• Align with Vulnerability Management function on remediation prioritization and risk treatment
• Support audit, regulatory, and control assurance activities

Required Qualifications:

• Minimum 5+ years in application security or software development roles with a focus on secure coding and DevSecOps.
• Strong understanding of application security principles, SDLC, and CI/CD pipelines.
• Strong understanding of application penetration testing
• Knowledge of secure coding standards and frameworks (e.g., OWASP Top 10, NIST).
• Excellent collaboration and communication skills to engage developers and stakeholders.

Preferred Qualifications:

• Hands-on experience with security tools (e.g., Secrets, SCA, SAST, Container security, DAST) and automation frameworks.
• Familiarity with cloud-native application security concepts.
• Certifications: OSCP, CISSP or preferred equivalent.
• Additional certifications such as Advanced application testing certifications (OSWP, GIAC GWAPT, INE eWPTX) are considered an advantage.

Tooling and Technology Coverage:

• In addition to SAST, DAST, and SCA, familiarity with complementary controls such as WAF and NAC were relevant to application-layer protection.
• Practical exposure to API security, Kubernetes and container platforms, Infrastructure as Code (IaC), hybrid cloud environments, and penetration testing or vulnerability scanning toolchains.

Pay: Php80,000.00 - Php100,000.00 per month

Work Location: Hybrid remote in Makati