Application Security Engineer — Pen Testing & Threat Modeling

Convene; Manila; On-site; PHP 1,200,000 - 2,400,000; Full time

Job summary

Convene in Manila is seeking a Security Engineer to dive into application security testing across Web and mobile apps. You will own the vulnerability lifecycle, conduct security investigations, and collaborate with Blue Team and DevOps to embed controls throughout the SDLC.

The role requires hands-on experience with Burp Suite, OWASP ZAP, Metasploit, and cloud security (AWS), plus relevant certifications such as CISA/CISSP are a plus.

Qualifications

• 5+ years of experience in application security testing and assessments.
• Solid understanding of OWASP Top 10 and SANS Critical Security Controls.
• Experience with security tools such as Burp Suite, ZAP, Metasploit, SonarQube.
• Proficiency in Java, JavaScript, and C/C++; scripting with Bash or PowerShell.
• Knowledge of AWS cloud and SIEM technologies; security certifications are a plus.

Responsibilities

• Perform penetration testing of Web and Mobile applications across platforms.
• Own vulnerability management lifecycle from identification to reporting.
• Monitor and detect operational security risks in the organization.
• Investigate security incidents and related tooling.
• Engage with users during Pre-sales and Support on security queries.
• Collaborate with Blue Team to implement security best practices in SDLC.
• Support threat modelling and security controls for ISO 27001 and SOC 2.

Skills

Application security

Penetration testing

Vulnerability management

Incident investigation

Blue Team collaboration

Threat modelling

Security awareness training

ISO 27001

SOC 2

CISA

CISM

CISSP

Tools

Burp Suite

OWASP ZAP

Metasploit

SonarQube

Ghidra

IDA

Java

JavaScript

C/C++

Bash

PowerShell

AWS

SIEM

Job description

Convene in Manila is seeking a Security Engineer to dive into application security testing across Web and mobile apps. You will own the vulnerability lifecycle, conduct security investigations, and collaborate with Blue Team and DevOps to embed controls throughout the SDLC.

The role requires hands-on experience with Burp Suite, OWASP ZAP, Metasploit, and cloud security (AWS), plus relevant certifications such as CISA/CISSP are a plus.