Security Engineer

Azeus Systems Limited; Cebu City; On-site; PHP 600,000 - 900,000; Full time

Job summary

Azeus Systems Limited in Cebu City, Philippines, is seeking an experienced Security Engineer to perform penetration testing of Web and Mobile apps and to own the vulnerability management lifecycle from identification to reporting.

The role involves active monitoring of security risks, technical investigations, and collaboration with pre-sales and support teams, as well as helping implement security practices across engineering and DevOps.

Qualifications

• 5+ years of experience in application security testing and assessments.
• Solid understanding of cybersecurity principles, standards and protocols (OWASP Top 10, SANS Critical Security Controls).
• Experience with security tools: Burp Suite, OWASP ZAP, Metasploit, SonarQube; Ghidra/IDA is a plus.
• Experience with programming languages: Java, JavaScript, C/C++.
• Experience with scripting: Bash and PowerShell.
• Experience with AWS cloud and SIEM technologies.
• Strong analytical skills and ownership.

Responsibilities

• Perform penetration testing of Web and Mobile applications.
• Own the vulnerability management lifecycle from identification to reporting.
• Active monitoring and detection of operational security risks.
• Conduct technical investigations on security incidents and tools.
• Liaise with users during Pre-sales and Support.
• Work with Engineering and DevOps to implement security best practices.
• Automate vulnerability detection as part of the SDLC.
• Support controls for ISO 27001 and SOC Type 2.

Skills

Application security testing

OWASP Top 10

SANS Critical Security Controls

Burp Suite

OWASP ZAP

Metasploit

SonarQube

Ghidra/IDA

Java

JavaScript

C/C++

Bash

PowerShell

AWS

SIEM

Threat modelling

Analytical skills

Tools

Burp Suite

OWASP ZAP

Metasploit

SonarQube

Ghidra

IDA Pro

Job description

• Perform penetration testing of Web and Mobile (iOS, Android, Windows, and Mac) applications
• Own the vulnerability management lifecycle from identification, remediation to reporting
• Active monitoring and detection of operational security risks in the organization
• Conduct technical investigations on security incidents and tools
• Liaise directly with users on security enquiries and concerns during Pre-sales and Support

About the Security Engineer role:

Responsibilities

Involved in Red Team activities:

• Perform penetration testing of Web and Mobile (iOS, Android, Windows, and Mac) applications
• Own the vulnerability management lifecycle from identification, remediation to reporting
• Active monitoring and detection of operational security risks in the organization
• Conduct technical investigations on security incidents and tools
• Liaise directly with users on security enquiries and concerns during Pre-sales and Support

Conduct engagement with the Blue Team for the following:

• Work with engineering and DevOps teams to implement security best practices
• Implement and improve workflows to automate vulnerability detection as part of the software development lifecycle
• Review risks and patches of software components used in the applications
• Facilitate threat modelling as part of the software development lifecycle
• Help in security awareness training
• Help in implementing the needed controls for different certification bodies such as ISO 27001 and SOC Type 2

Requirements

Qualifications

• At least 5 years of experience in application security testing and assessments
• Solid understanding of cybersecurity principles, standards, and protocols such as OWASP Top 10 and SANS Critical Security Controls
• Experience with application security tools such as Burpsuite, OWASP ZAP, Metasploit, SonarQube (experience with Ghidra or IDA is a plus)
• Experience with programming languages such as Java, JavaScript, C/C++
• Experience with scripting languages such as Bash or PowerShell
• Experience and knowledge of cloud solutions and architectures such as AWS
• Experience and knowledge of Security Information and Event Management (SIEM) technologies
• Good analytical skills
• Strong sense of ownership
• Technical and industry certifications such as CISA, CISM, CISSP are a plus

Others:

• Successful completion of background check and NBI clearance will be required