Hybrid Application Security Threat Modeling Engineer

Manulife; Quezon City; Hybrid; PHP 1,200,000 - 2,400,000; Full time

Job summary

Manulife seeks an experienced Application Security Engineer specializing in Threat Modeling to partner with engineering, architecture, and risk teams. You will lead threat modeling engagements, document system assets, data flows, and trust boundaries, and translate risks into actionable mitigations throughout the SDLC.

You will apply methods like STRIDE, PASTA, or LINDDUN, assess threats with business context, and ensure governance and reusable guidance are in place.

Qualifications

• Bachelor's degree or equivalent practical experience in a related field.
• At least five years of experience in threat modeling, application security, or related disciplines.
• Experience leading threat modeling or secure design reviews for modern architectures.
• Ability to analyze architectures, identify trust boundaries, and translate findings into actionable mitigations.
• Practical knowledge of at least one threat modeling method (STRIDE, PASTA, etc.).
• Working knowledge of cloud, containers, APIs, and common attack techniques.
• Familiarity with OWASP, MITRE ATT&CK, and NIST Secure SDLC guidance.
• Experience embedding threat modeling into architecture governance and Secure SDLC activities.
• Strong analytical, facilitation, and stakeholder-management skills.
• Hybrid work availability at UP Ayala Technohub, Quezon City, three onsite days per week.

Responsibilities

• Independently lead threat modeling engagements for applications, APIs, cloud services, and integrations.
• Document system components, data flows, trust boundaries, and key assumptions with engineering teams.
• Apply threat modeling methods suitable for the system and context.
• Assess threats and document defensible risk decisions with business context.
• Translate threats into practical security requirements, design guidance, and remediation actions.
• Provide governance and quality oversight across threat modeling activities.
• Embed threat modeling into architecture reviews, Secure SDLC, and testing.
• Develop and maintain threat libraries, design patterns, and reusable guidance.
• Coach teams and communicate outcomes, trends, and risks to stakeholders.
• Produce metrics and reports showing risk reduction and delivery quality.

Skills

Threat modeling

Application security

Security architecture

Secure SDLC

Facilitation

Stakeholder management

Technical writing

Education

Bachelor’s degree in Computer Science, Software Engineering, Information Technology, Cybersecurity, or equivalent

Tools

Microsoft Threat Modeling Tool

OWASP Threat Dragon

IriusRisk

pytm

Visio

Job description

Manulife seeks an experienced Application Security Engineer specializing in Threat Modeling to partner with engineering, architecture, and risk teams. You will lead threat modeling engagements, document system assets, data flows, and trust boundaries, and translate risks into actionable mitigations throughout the SDLC.

You will apply methods like STRIDE, PASTA, or LINDDUN, assess threats with business context, and ensure governance and reusable guidance are in place.