DevSecOps Application Security Engineer

Ascendion; Taguig; On-site; PHP 1,200,000 - 1,800,000; Full time

Job summary

Ascendion is seeking a hands-on security engineer to design and secure CI/CD pipelines, performing SAST/DAST/SCA scans and guiding secure coding across teams. You will collaborate with security architects, threat modeling, and platform owners to minimize risk.

Responsibilities include artifact signing, license compliance, CSPM, IaC security reviews, and GenAI-assisted vulnerability triage, with a strong emphasis on governance, reporting, and cross-functional partnership.

Qualifications

• Hands-on experience designing and securing CI/CD pipelines.
• Experience with SAST, DAST, SCA, secrets scanning, container scanning, and SBOM.
• Familiarity with security tools such as GitHub Advanced Security, Checkmarx, Snyk, Trivy, OWASP ZAP, IriusRisk.
• Applied knowledge of application security testing, vulnerability triage and secure code reviews.
• Knowledge of OWASP Top 10 and secure cryptography concepts.
• Experience with artifact signing, provenance, and license compliance.
• Ability to work with security architects, threat modeling, and platform owners.

Responsibilities

• Lead and participate in vulnerability triage and remediation.
• Support secure coding practices and API security testing.
• Collaborate on governance, audits, and security metrics reporting.
• Implement IaC security reviews for Terraform/Bicep.
• Assist with GenAI-driven vulnerability triage and remediation recommendations.

Skills

DevSecOps

CI/CD Security

Threat Modeling

Security Governance

Vulnerability Management

Tools

GitHub Advanced Security

Checkmarx

Snyk

Trivy

OWASP ZAP

IriusRisk

Terraform

Bicep

Job description

Ascendion is seeking a hands-on security engineer to design and secure CI/CD pipelines, performing SAST/DAST/SCA scans and guiding secure coding across teams. You will collaborate with security architects, threat modeling, and platform owners to minimize risk.

Responsibilities include artifact signing, license compliance, CSPM, IaC security reviews, and GenAI-assisted vulnerability triage, with a strong emphasis on governance, reporting, and cross-functional partnership.