Security Engineer: Red Team & App Penetration Expert

Convene; Metro Manila; On-site; PHP 1,000,000 - 2,000,000; Full time

Job summary

Convene is seeking a Security Engineer to perform penetration testing of Web and Mobile apps and to own the vulnerability management lifecycle end-to-end. The role involves monitoring security risks, investigating incidents, and liaising with users during Pre-sales and Support.

You will collaborate with engineering and DevOps to implement security best practices, automate detection in the SDLC, and support ISO 27001 and SOC Type 2 controls.

Qualifications

• Minimum of 5 years in application security testing and assessments.
• Knowledge of security standards such as OWASP Top 10 and SANS Critical Security Controls.
• Experience with security tools listed in the qualifications (Burp Suite, OWASP ZAP, Metasploit, SonarQube).
• Experience with programming languages (Java, JavaScript, C/C++).
• Scripting experience (Bash or PowerShell).
• Cloud knowledge (AWS) and SIEM technologies.

Responsibilities

• Penetration testing of Web and Mobile (iOS, Android, Windows, Mac) applications.
• Own the vulnerability management lifecycle from identification to remediation and reporting.
• Active monitoring and detection of security risks in the organization.
• Conduct technical investigations on security incidents and tools.
• Liaise with users on security inquiries during Pre-sales and Support.
• Work with engineering/DevOps to implement security best practices.
• Automate vulnerability detection as part of the SDLC.
• Review risks and patches of software components used in apps.
• Facilitate threat modelling and security awareness training.

Skills

Penetration testing

OWASP Top 10

Burp Suite

OWASP ZAP

Metasploit

SonarQube

Ghidra/IDA

Java/JavaScript/C/C++

Bash/PowerShell

AWS

SIEM

Analytical skills

Ownership

Tools

Notepad++

Job description

Convene is seeking a Security Engineer to perform penetration testing of Web and Mobile apps and to own the vulnerability management lifecycle end-to-end. The role involves monitoring security risks, investigating incidents, and liaising with users during Pre-sales and Support.

You will collaborate with engineering and DevOps to implement security best practices, automate detection in the SDLC, and support ISO 27001 and SOC Type 2 controls.