Lead DevSecOps Engineer – SAST, DAST & Cloud Security

Comrise; Taguig; On-site; PHP 1,200,000 - 2,400,000; Full time

Job summary

Comrise in Manila seeks an Application Security Engineer to embed security in the SDLC and drive DevSecOps, automation, code scanning, and cloud security.

You will design and maintain secure CI/CD pipelines with SAST/DAST/SCA, and work with tools like GitHub Advanced Security, Checkmarx, Snyk, Trivy, and OWASP ZAP to improve security posture.

Collaborate with security, architecture, and cloud teams to shift left through scalable, self-service controls and robust secure coding practices.

Qualifications

• Minimum 8-12 years in technology with 5+ years in Application Security.
• Hands-on DevSecOps with SAST, DAST, SCA, and SBOM.
• Experience with Azure cloud security and IaC.
• Strong knowledge of OWASP Top 10, NIST, secure coding.

Responsibilities

• Lead secure SDLC practices and embed security in CI/CD pipelines.
• Perform security testing including SAST/DAST and API security testing.
• Triage vulnerabilities and provide remediation guidance to engineers.
• Collaborate with engineering to implement guardrails and standards.
• Conduct threat modeling and security reviews.
• Maintain secure coding standards and IaC security reviews.

Skills

DevSecOps pipelines

Security engineering

Threat modeling

Secure coding practices

Cloud security

Tools

GitHub Advanced Security

Checkmarx

Snyk

Trivy

OWASP ZAP

Terraform

Bicep

Job description

Comrise in Manila seeks an Application Security Engineer to embed security in the SDLC and drive DevSecOps, automation, code scanning, and cloud security.

You will design and maintain secure CI/CD pipelines with SAST/DAST/SCA, and work with tools like GitHub Advanced Security, Checkmarx, Snyk, Trivy, and OWASP ZAP to improve security posture.

Collaborate with security, architecture, and cloud teams to shift left through scalable, self-service controls and robust secure coding practices.