Application Security Engineer

Key Responsibilities

• Design, build, and operate secure DevSecOps/CI/CD pipelines integrating SAST, DAST, SCA, secrets detection, container scanning, and SBOM generation.
• Implement and maintain security tooling such as GitHub Advanced Security, Checkmarx, Snyk, Trivy, OWASP ZAP, or equivalent enterprise security tools.
• Conduct application security testing, vulnerability assessment, secure code reviews, and remediation validation.
• Triage and prioritize security findings and provide clear, engineer-ready remediation guidance.
• Establish and maintain secure coding standards based on OWASP Top 10 and secure development principles.
• Implement Azure cloud security controls, including IAM, Key Vault, network controls, container/Kubernetes security, and Infrastructure-as-Code (IaC) scanning.
• Support software supply-chain security through SCA, SBOM generation, dependency management, artifact integrity, and CVE monitoring.
• Collaborate with engineering, security, architecture, and platform teams to embed security controls into development workflows.
• Monitor security tooling coverage, vulnerability trends, and remediation progress, recommending continuous improvements.
• Support security governance, risk management, and audit requirements aligned with NIST, OWASP, and related security standards.
• Leverage automation and emerging AI-assisted security capabilities to improve security engineering efficiency where appropriate.

Non-Negotiable Requirements

• 8–12 years of experience in Technology, with at least 5 years in Application Security Engineering, DevSecOps, or Security Engineering involving hands-on pipeline and security tooling ownership.
• Demonstrable experience designing and operating DevSecOps pipelines, including SAST, DAST, SCA, secrets detection, container scanning, and SBOM generation integrated into CI/CD.
• Hands-on experience with enterprise security tooling such as GitHub Advanced Security, Checkmarx, Snyk, Trivy, OWASP ZAP, or equivalent tools.
• Strong working knowledge of Azure cloud security, including IAM, Key Vault, network security controls, container/Kubernetes security, and IaC scanning.
• Strong knowledge of OWASP Top 10, NIST, secure coding principles, and vulnerability management.
• Ability to analyze security findings and translate them into clear, actionable remediation guidance for engineers.

Pay: Php120,000.00 - Php150,000.00 per month

Benefits:

• Promotion to permanent employee

Experience:

• DevSecOps: 3 years (Required)
• Azure Cloud: 3 years (Required)

Work Location: Hybrid remote in Taguig