Application Security Enablement Engineer

Manulife; Asia; On-site; PEN 310,000 - 551,000; Full time

Job summary

Manulife is seeking an Application Security Enablement Engineer to drive secure development practices across Asia. You will embed security into the SDLC, drive threat modeling, vulnerability remediation, and risk-based guidance for developers and architects.

Join a regional security leadership team and influence security strategy across markets, leveraging automation and security tooling to strengthen platform and cloud security postures.

Qualifications

• Minimum 5+ years in application security or secure software development.
• Strong understanding of SDLC, CI/CD, and secure coding standards.
• Experience with penetration testing and threat modeling.

Responsibilities

• Drive enterprise application security standards across apps, platforms, and cloud.
• Enable automation for vulnerability detection, remediation, and reporting.
• Provide technical guidance and training on secure design and coding (OWASP).
• Embed secure-by-design principles with architects and Dev teams.
• Lead vulnerability management and risk-based remediation activities.

Skills

Secure coding

DevSecOps

Application security

Threat modeling

CI/CD

Tools

SAST

DAST

SCA

Container security

Kubernetes

Job description

Application Security Enablement Engineer

The Asia CISO function is responsible for ensuring effective cybersecurity risk management, regulatory compliance, and secure technology enablement across all Asia markets. This role sits within the regional cybersecurity leadership team and is accountable for application security enablement across the software development lifecycle. It serves as the bridge between global application security strategy and regional execution, driving outcomes through strong partnership and influence across application development, engineering, and architecture teams in both regional and market environments.

Deliver application security engineering and enablement capabilities across Asia, embedding secure development practices into the software development lifecycle (SDLC) and enabling adoption of enterprise security standards. This role focuses on driving vulnerability assessment, prioritization and remediation, centralized exception review, threat modeling, and SME support to strengthen application security posture.

Position Responsibilities

• Help drive adoption of enterprise application security standards across applications, platforms, and cloud environments
• Enable automation for vulnerability detection, remediation, exception review and reporting to improve efficiency and consistency.
• Provide actionable, risk-based technical guidance and training to developers on secure design and coding standards (e.g., OWASP).
• Partner with architects, product owners, and development teams during design and planning phases to embed secure-by-design principles.
• Conduct and validate application security testing (automated and manual), including intake and validation of findings from external penetration tests and bug bounty programs.

Accountabilities

Individual Accountabilities

• Support vulnerability management processes, including triage, exception review, remediation, and reporting.
• Conduct application and architecture-level Threat Modeling for new applications, major enhancements, and high-risk changes.
• Support uplift of Threat Modeling maturity by defining templates, playbooks, and reusable threat libraries for common platforms and patterns.
• Support to scale workstreams such as secrets, SCA, SAST, DAST vulnerability remediation.
• Partner with development teams to integrate security expectations into CI/CD pipelines and DevSecOps workflows.
• Validate and contextualize findings from automated tools, penetration tests, and external assessments where design-level issues are identified.

Key Shared Accountabilities

• Partner with Global Application Security on standards, tooling and continuous improvement
• Collaborate with CIO, engineering, and architecture teams to ensure consistent adoption and accountability
• Align with Vulnerability Management function on remediation prioritization and risk treatment
• Support audit, regulatory, and control assurance activities

Required Qualifications

• Minimum 5+ years in application security or software development roles with a focus on secure coding and DevSecOps.
• Strong understanding of application security principles, SDLC, and CI/CD pipelines.
• Strong understanding of application penetration testing
• Knowledge of secure coding standards and frameworks (e.g., OWASP Top 10, NIST).
• Excellent collaboration and communication skills to engage developers and stakeholders.

Preferred Qualifications

• Hands-on experience with security tools (e.g., Secrets, SCA, SAST, Container security, DAST) and automation frameworks.
• Familiarity with cloud-native application security concepts.
• Certifications: OSCP, CISSP or preferred equivalent.
• Additional certifications such as Advanced application testing certifications (OSWP, GIAC GWAPT, INE eWPTX) are considered an advantage.

Tooling and Technology Coverage

• In addition to SAST, DAST, and SCA, familiarity with complementary controls such as WAF and NAC were relevant to application-layer protection.
• Practical exposure to API security, Kubernetes and container platforms, Infrastructure as Code (IaC), hybrid cloud environments, and penetration testing or vulnerability scanning toolchains.

When you join our team

• We’ll empower you to learn and grow the career you want.
• We’ll recognize and support you in a flexible environment where well-being and inclusion are more than just words.
• As part of our global team, we’ll support you in shaping the future you want to see.

Join our team as an Application Security Engineer, where you will independently review and validate penetration test reports, ensuring technical accuracy and risk-based remediation. Collaborate with cross-functional teams to maintain high-quality standards. Ideal for candidates with strong experience in application security and penetration testing.

We are expanding our team: As an Application Security Engineer specializing in Threat Modeling, you will lead security engagements, identify design risks, and translate them into actionable security requirements. Ideal candidates bring significant experience in application security and threat modeling within technical or business environments.

Join our team as a Security Engineer to lead application security assessments and drive remediation efforts across Manulife's digital platforms. Take ownership of security programs, mentor peers, and contribute to the development of security standards. Ideal for candidates with strong hands-on experience in secure software development and leadership within financial services.

We believe that embracing inclusion is the key to creating a stronger, more resilient organization. It's not just a value - it's a strategic advantage that sets us apart.