Application Security Engineer

eTeam; Taguig; On-site; PHP 2,400,000 - 3,200,000; Full time

Job summary

eTeam is seeking an experienced security engineering professional to own DevSecOps pipelines across global engineering teams. You will design, implement and operate SAST/DAST/SCA workflows integrated into CI/CD, and manage security tooling in an enterprise environment.

Ideal candidates have 8–12 years in technology with 5+ years in application security or DevSecOps, Azure security knowledge (IAM, Key Vault), and strong OWASP/NIST fluency.

Qualifications

• 8–12 years in technology with 5+ years in application security/DevSecOps or security-engineering role with hands-on pipeline ownership.
• Proven ability to design and operate DevSecOps pipelines: SAST, DAST, SCA, secrets detection, SBOM in CI/CD.
• Hands-on experience with security tooling in enterprise environments (GitHub Advanced Security, Checkmarx, Snyk, Trivy, OWASP ZAP).
• Azure cloud security engineering knowledge: IAM, Key Vault, network controls, container/Kubernetes security, IaC scanning.
• Knowledge of OWASP Top 10, NIST, secure coding and vulnerability management; able to translate findings into remediation guidance.

Skills

Security engineering

DevSecOps pipelines

Security tooling

Azure security

OWASP/NIST knowledge

Tools

GitHub Advanced Security

Checkmarx

Snyk

Trivy

OWASP ZAP

Job description

• 8-12 years in technology, with 5+ years in application security engineering, DevSecOps or a security-engineering role with hands‑on pipeline and tooling ownership.
• Demonstrable experience designing and operating DevSecOps pipelines: SAST, DAST, SCA, secrets detection, container scanning and SBOM generation integrated into CI/CD.
• Hands‑on experience with security tooling (GitHub Advanced Security, Checkmarx, Snyk, Trivy, OWASP ZAP or equivalent) in enterprise engineering environments.
• Azure cloud security engineering knowledge: IAM, Key Vault, network controls, container/Kubernetes security, IaC scanning.
• Working knowledge of OWASP Top 10, NIST, secure coding principles and vulnerability management, with ability to translate findings into engineer‑ready remediation guidance.

Preferred Qualifications

• Insurance or financial‑services industry experience.
• Security certifications (CSSLP, CEH, OSCP, GWEB) and/or Azure security certifications (AZ-500, SC-100).
• Experience applying AI and automation to security engineering (GenAI‑assisted triage, agentic pipelines, GitHub Copilot for secure code review).
• Experience enabling federated engineering teams and security champions at scale, across distributed LOB structures.
• Familiarity with IriusRisk, threat modelling tooling or security architecture review as a consumer of outputs from those practices.
• Technical: DevSecOps pipeline engineering, SAST / DAST / SCA / SBOM, build integrity and supply chain security, Azure cloud security (IAM, Key Vault, CSPM, IaC), secrets management, container and Kubernetes security, OWASP / NIST / ISO 27001, vulnerability triage and management, AI and automation (GenAI, Copilot, agents).
• Collaboration: clear written and verbal communication of technical risk to non‑specialist audiences, ability to embed into delivery teams without becoming a bottleneck, structured prioritisation and critical thinking, coaching and enablement mindset.

Work Conditions

• Work with global teams across multiple time zones and across the HWC lines of business

• 8-12 years in technology, with 5+ years in application security engineering, DevSecOps or a security‑engineering role with hands‑on pipeline and tooling ownership.
• Demonstrable experience designing and operating DevSecOps pipelines: SAST, DAST, SCA, secrets detection, container scanning and SBOM generation integrated into CI/CD.
• Hands‑on experience with security tooling (GitHub Advanced Security, Checkmarx, Snyk, Trivy, OWASP ZAP or equivalent) in enterprise engineering environments.
• Azure cloud security engineering knowledge: IAM, Key Vault, network controls, container/Kubernetes security, IaC scanning.
• Working knowledge of OWASP Top 10, NIST, secure coding principles and vulnerability management, with ability to translate findings into engineer‑ready remediation guidance.