Application Security QA Engineer — Pen Test Report Quality

Manulife/John Hancock; Manila; Hybrid; PHP 900,000 - 1,300,000; Full time

Benefits offered by this job

Hybrid work arrangement

Job summary

Manulife/John Hancock is seeking an experienced Application Security Engineer to act as the quality-assurance point for penetration testing deliverables across applications and APIs. You will review reports, validate evidence, and guide remediation with risk-based guidance for business stakeholders.

The role is a hands-on, individual contributor position requiring strong knowledge of web and API security, OWASP practices, and remediation validation, with a hybrid work model in Manila, three

Qualifications

• Hands-on experience reviewing penetration test reports and validating evidence.
• Ability to assess exploitability and business impact, and challenge severity ratings.
• Experience with remediation validation and retesting to close findings.
• Knowledge of OWASP testing practices, CVSS, CWE, and vulnerability classification.
• Experience with end-to-end vulnerability management and DevSecOps pipelines.

Responsibilities

• Perform final quality reviews of penetration test reports before release, ensuring findings are accurate and well-supported.
• Validate affected assets, exploitation paths, business impact, and false positives; challenge improper conclusions.
• Review severity ratings and calibrate using CVSS, asset criticality, and controls.
• Ensure test scope, methodology, coverage, and limitations are documented; work with testers to address gaps.
• Provide risk-based remediation guidance and drive evidence for closure.
• Track findings, remediation dates, retesting, and closure decisions with stakeholders.
• Triage new vulnerabilities and determine relevance and escalation as needed.
• Support Burp Suite and Snyk operations, including configuration and reporting.
• Maintain quality templates and procedures; propose improvements to processes.
• Produce status updates and highlight material risks to stakeholders.

Skills

Penetration testing reviews

Web/API security

CVSS/CWE knowledge

Burp Suite Pro

SAST/DAST/DevSecOps

Stakeholder communication

Education

Bachelor’s degree in Computer Science/Engineering or related field

Tools

Burp Suite Professional

Snyk

Job description

Manulife/John Hancock is seeking an experienced Application Security Engineer to act as the quality-assurance point for penetration testing deliverables across applications and APIs. You will review reports, validate evidence, and guide remediation with risk-based guidance for business stakeholders.

The role is a hands-on, individual contributor position requiring strong knowledge of web and API security, OWASP practices, and remediation validation, with a hybrid work model in Manila, three