Security Engineer

Azeus Convene; Cebu City; On-site; PHP 1,400,000 - 2,000,000; Full time

Job summary

Azeus Convene in the Philippines seeks an experienced Security Engineer to advance application security. You will perform web and mobile pentests, own vulnerability lifecycle, monitor security risks, investigate incidents, and liaise with users during pre-sales and support.

You will work with the Blue Team to implement security best practices, automate vulnerability detection in the SDLC, review component risks, support threat modelling, security awareness, and assist with ISO 27001 and SOC 2

Qualifications

• 5+ years in application security testing and assessments.
• Solid understanding of cybersecurity principles, standards, and protocols such as OWASP Top 10 and SANS Critical Security Controls.
• Experience with application security tools such as Burp Suite, OWASP ZAP, Metasploit, SonarQube; Ghidra/IDA a plus.
• Experience with Java, JavaScript, C/C++ and scripting languages like Bash or PowerShell.
• Experience and knowledge of AWS cloud, SIEM technologies, and security certifications are a plus.

Responsibilities

• Perform penetration testing of Web and Mobile applications (iOS, Android, Windows, Mac).
• Own the vulnerability management lifecycle from identification through remediation to reporting.
• Monitor and detect operational security risks.
• Investigate security incidents and security tools.
• Liaise with users during Pre-sales and Support; collaborate with Blue Team to improve security practices.
• Automate vulnerability detection within the software development lifecycle.
• Review risks and patches of software components; facilitate threat modelling.
• Assist in security awareness training; support ISO 27001 and SOC 2 controls.

Skills

App security

Cloud security (AWS)

SIEM

Threat modelling

Incident response

Tools

Burp Suite

OWASP ZAP

Metasploit

SonarQube

Ghidra

IDA

Job description

About the Security Engineer role:

Responsibilities

Involved in Red Team activities:

• Perform penetration testing of Web and Mobile (iOS, Android, Windows, and Mac) applications
• Own the vulnerability management lifecycle from identification, remediation to reporting
• Active monitoring and detection of operational security risks in the organization
• Conduct technical investigations on security incidents and tools
• Liaise directly with users on security enquiries and concerns during Pre-sales and Support

Conduct engagement with the Blue Team for the following:

• Work with engineering and DevOps teams to implement security best practices
• Implement and improve workflows to automate vulnerability detection as part of the software development lifecycle
• Review risks and patches of software components used in the applications
• Facilitate threat modelling as part of the software development lifecycle
• Help in security awareness training
• Help in implementing the needed controls for different certification bodies such as ISO 27001 and SOC Type 2

Requirements

Qualifications

• At least 5 years of experience in application security testing and assessments
• Solid understanding of cybersecurity principles, standards, and protocols such as OWASP Top 10 and SANS Critical Security Controls
• Experience with application security tools such as Burpsuite, OWASP ZAP, Metasploit, SonarQube (experience with Ghidra or IDA is a plus)
• Experience with programming languages such as Java, JavaScript, C/C++
• Experience with scripting languages such as Bash or PowerShell
• Experience and knowledge of cloud solutions and architectures such as AWS
• Experience and knowledge of Security Information and Event Management (SIEM) technologies
• Good analytical skills
• Strong sense of ownership
• Technical and industry certifications such as CISA, CISM, CISSP are a plus

Others:

• Successful completion of background check and NBI clearance will be required.