Application Security Engineer, Application Security Lead- 80K SOB

Bravissimo Resourcing Inc.; Quezon City; On-site; PHP 800,000 - 1,200,000; Full time

Job summary

A talent acquisition firm is seeking an experienced Application Security Engineer to embed security into the software development lifecycle. The ideal candidate will have at least 2 years of experience with Android Malware Reverse, along with knowledge of application security tools and cloud environments. The role involves implementing security testing programs and performing API security assessments. Candidates should possess relevant security certifications and have strong collaboration skills.

Qualifications

• Minimum 2 years of experience in Android Malware Reverse.
• Experience with common application security tools like Fortify, Checkmarx.
• Security certifications (e.g., CSSLP, GWAPT, OSCP) or cloud certifications.

Responsibilities

• Embed security into the SDLC by partnering with engineering and DevOps teams.
• Implement and maintain application security testing programs.
• Perform API security testing and conduct security penetration testing.

Skills

Embed security into SDLC

DevOps / DevSecOps & Delivery Tooling

Cloud & Engineering Background

Professional / Collaboration Skills

Experience with common AppSec tools

Experience with WAF, API gateways

Security certifications

Job description

Application Security Engineer, Application Security Lead (DevSecOps / Azure DevOps)

Must experience: Minimum 2 years of experience in Android Malware Reverse

Qualifications

• Embed security into the SDLC by partnering with engineering and DevOps teams across planning, design, build, test, and release.
• DevOps / DevSecOps & Delivery Tooling
• Cloud & Engineering Background
• Professional / Collaboration Skills
• Experience with common AppSec tools (examples): Fortify/Checkmarx/Veracode/SonarQube (SAST), OWASP ZAP/Burp (DAST), Snyk/Mend/Black Duck (SCA).
• Experience with WAF, API gateways, or service mesh security controls.
• Security certifications (e.g., CSSLP, GWAPT, OSCP) or cloud certifications (AZ-500, AWS Security Specialty, GCP Security Engineer).

Roles and Responsibilities

• Embed security into the SDLC by partnering with engineering and DevOps teams across planning, design, build, test, and release.
• Implement and maintain application security testing programs, including:
• SAST (Static Application Security Testing)
• DAST (Dynamic Application Security Testing)
• SCA (Software Composition Analysis)
• IAST (Interactive Application Security Testing)
• RASP (Runtime Application Self-Protection)
• Integrate security scanning and quality gates into Azure DevOps pipelines (Build/Release), ensuring repeatable and automated controls.
• Perform API security testing, including authentication/authorization validation, rate limiting checks, schema validation, and abuse testing.
• Conduct and/or coordinate security penetration testing and validate remediation effectiveness.
• Lead threat modeling and secure design reviews for new features, services, and architectures (microservices, serverless, containerized workloads).