Security Engineer

Convene; Metro Manila; Presencial; PHP 1.000.000 - 2.000.000; Jornada completa

Descripción de la vacante

Convene is seeking a Security Engineer to perform penetration testing of Web and Mobile apps and to own the vulnerability management lifecycle end-to-end. The role involves monitoring security risks, investigating incidents, and liaising with users during Pre-sales and Support.

You will collaborate with engineering and DevOps to implement security best practices, automate detection in the SDLC, and support ISO 27001 and SOC Type 2 controls.

Formación

• Minimum of 5 years in application security testing and assessments.
• Knowledge of security standards such as OWASP Top 10 and SANS Critical Security Controls.
• Experience with security tools listed in the qualifications (Burp Suite, OWASP ZAP, Metasploit, SonarQube).
• Experience with programming languages (Java, JavaScript, C/C++).
• Scripting experience (Bash or PowerShell).
• Cloud knowledge (AWS) and SIEM technologies.

Responsabilidades

• Penetration testing of Web and Mobile (iOS, Android, Windows, Mac) applications.
• Own the vulnerability management lifecycle from identification to remediation and reporting.
• Active monitoring and detection of security risks in the organization.
• Conduct technical investigations on security incidents and tools.
• Liaise with users on security inquiries during Pre-sales and Support.
• Work with engineering/DevOps to implement security best practices.
• Automate vulnerability detection as part of the SDLC.
• Review risks and patches of software components used in apps.
• Facilitate threat modelling and security awareness training.

Conocimientos

Penetration testing

OWASP Top 10

Burp Suite

OWASP ZAP

Metasploit

SonarQube

Ghidra/IDA

Java/JavaScript/C/C++

Bash/PowerShell

AWS

SIEM

Analytical skills

Ownership

Herramientas

Notepad++

Descripción del empleo

Involved In Red Team Activities

Perform penetration testing of Web and Mobile (iOS, Android, Windows, and Mac) applications

Responsibilities

About the Security Engineer role:

• Perform penetration testing of Web and Mobile (iOS, Android, Windows, and Mac) applications


• Own the vulnerability management lifecycle from identification, remediation to reporting


• Active monitoring and detection of operational security risks in the organization


• Conduct technical investigations on security incidents and tools


• Liaise directly with users on security enquiries and concerns during Pre-sales and Support

Conduct Engagement With The Blue Team For The Following

• Work with engineering and DevOps teams to implement security best practices


• Implement and improve workflows to automate vulnerability detection as part of the software development lifecycle


• Review risks and patches of software components used in the applications


• Facilitate threat modelling as part of the software development lifecycle


• Help in security awareness training


• Help in implementing the needed controls for different certification bodies such as ISO 27001 and SOC Type 2

Qualifications

• At least 5 years of experience in application security testing and assessments


• Solid understanding of cybersecurity principles, standards, and protocols such as OWASP Top 10 and SANS Critical Security Controls


• Experience with application security tools such as Burpsuite, OWASP ZAP, Metasploit, SonarQube (experience with Ghidra or IDA is a plus)


• Experience with programming languages such as Java, JavaScript, C/C++


• Experience with scripting languages such as Bash or PowerShell


• Experience and knowledge of cloud solutions and architectures such as AWS


• Experience and knowledge of Security Information and Event Management (SIEM) technologies


• Good analytical skills


• Strong sense of ownership


• Technical and industry certifications such as CISA, CISM, CISSP are a plus

Others

• Successful completion of background check and NBI clearance will be required.