Application Security Enablement Engineer

PAN ASIA HR CONSULTING PH INC.; Quezon City; On-site; PHP 1,000,000 - 1,800,000; Full time

Job summary

PAN ASIA HR CONSULTING PH INC. is seeking an experienced Application Security professional to drive security standards across enterprise applications, platforms, and cloud environments.

You will enable automation for vulnerability detection, remediation, and reporting, while guiding developers on secure design and coding practices (OWASP, NIST). You will partner with architects and development teams to embed secure-by-design principles, conduct security testing, and support vulnerability

Qualifications

• Minimum 5+ years in application security or software development with secure coding focus.
• Strong understanding of security principles, SDLC, and CI/CD pipelines.
• Experience with application penetration testing.
• Knowledge of secure coding standards (OWASP Top 10, NIST).
• Excellent collaboration and communication with developers and stakeholders.
• Hands-on with security tools (Secrets, SCA, SAST, container security, DAST) and automation.
• Familiarity with cloud-native security concepts and hybrid cloud environments.
• Certifications such as OSCP or CISSP are preferred.

Responsibilities

• Drive enterprise application security standards across apps, platforms, and cloud environments.
• Enable automation for vulnerability detection, remediation, and reporting.
• Provide actionable guidance and training on secure design and coding standards.
• Partner with architects and product teams to embed secure-by-design principles.
• Conduct and validate application security testing (automated and manual).
• Support vulnerability management: triage, remediation, and reporting.
• Perform Threat Modeling for new apps and high-risk changes.
• Develop templates and playbooks to uplift Threat Modeling maturity.
• Integrate security expectations into CI/CD pipelines and DevSecOps workflows.
• Contextualize findings from tools and external assessments.

Skills

Application security

DevSecOps

CI/CD pipelines

Threat modeling

OWASP Top 10

Communication

Penetration testing

Cloud security

Automation frameworks

Kubernetes security

Tools

Secrets management

SCA

SAST

Container security

DAST

Job description

About the role

This is an Application Security role focused on driving enterprise application security standards across applications, platforms, and cloud environments. You will enable automation for vulnerability detection, remediation, exception review and reporting to improve efficiency and consistency, while providing actionable, risk-based technical guidance and training to developers on secure design and coding standards.

Key responsibilities

• Help drive adoption of enterprise application security standards across applications, platforms, and cloud environments

• Enable automation for vulnerability detection, remediation, exception review and reporting to improve efficiency and consistency

• Provide actionable, risk-based technical guidance and training to developers on secure design and coding standards (e.g., OWASP)

• Partner with architects, product owners, and development teams during design and planning phases to embed secure-by-design principles

• Conduct and validate application security testing (automated and manual), including intake and validation of findings from external penetration tests and bug bounty programs

• Support vulnerability management processes, including triage, exception review, remediation, and reporting

• Conduct application and architecture-level Threat Modeling for new applications, major enhancements, and high-risk changes

• Support uplift of Threat Modeling maturity by defining templates, playbooks, and reusable threat libraries for common platforms and patterns

• Partner with development teams to integrate security expectations into CI/CD pipelines and DevSecOps workflows

• Validate and contextualize findings from automated tools, penetration tests, and external assessments where design-level issues are identified

About you

• Minimum 5+ years in application security or software development roles with a focus on secure coding and DevSecOps

• Strong understanding of application security principles, SDLC, and CI/CD pipelines

• Strong understanding of application penetration testing

• Knowledge of secure coding standards and frameworks (e.g., OWASP Top 10, NIST)

• Excellent collaboration and communication skills to engage developers and stakeholders

• Hands-on experience with security tools (e.g., Secrets, SCA, SAST, Container security, DAST) and automation frameworks

• Familiarity with cloud-native application security concepts

• Certifications: OSCP, CISSP or preferred equivalent

• Practical exposure to API security, Kubernetes and container platforms, Infrastructure as Code (IaC), hybrid cloud environments, and penetration testing or vulnerability scanning toolchains