Application Security QA Engineer — Penetration Testing

manulife; Quezon City; Hybrid; PHP 1,200,000 - 2,000,000; Full time

Job summary

Manulife is seeking an experienced security tester to review penetration test reports, validate evidence, and calibrate severity for web applications and APIs. The role requires hands-on testing, strong knowledge of OWASP practices, and the ability to communicate risk to technical and business stakeholders.

The ideal candidate has 3+ years in security QA, experience with Burp Suite and Snyk, and will operate in a hybrid arrangement with onsite days in Quezon City, Philippines.

Qualifications

• 3+ years in penetration testing or security QA.
• Review reports, validate evidence and assess impact.
• Knowledge of OWASP testing practices and CVSS.
• Hybrid work requirements with onsite days in Quezon City.

Responsibilities

• Perform final quality reviews of penetration test reports for accuracy and evidence.
• Validate assets, exploitation paths, business impact, and false positives.
• Calibrate severity using CVSS, asset criticality, and controls.
• Ensure scope, methodology, and conclusions are clear and complete.
• Provide remediation guidance and evidence for closure.
• Track findings, remediation dates, and retesting outcomes.
• Triage new vulnerabilities for relevance and escalation.
• Support Burp Suite and Snyk operations and coordination.
• Maintain quality templates and report standards; suggest improvements.
• Produce status updates and raise material risks to stakeholders.

Skills

Penetration testing

Web security

Burp Suite

SAST/DAST

Threat assessment

Education

Bachelor's degree or equivalent practical experience

Related field or experience

Tools

Burp Suite Professional

Snyk

Job description

Manulife is seeking an experienced security tester to review penetration test reports, validate evidence, and calibrate severity for web applications and APIs. The role requires hands-on testing, strong knowledge of OWASP practices, and the ability to communicate risk to technical and business stakeholders.

The ideal candidate has 3+ years in security QA, experience with Burp Suite and Snyk, and will operate in a hybrid arrangement with onsite days in Quezon City, Philippines.