Senior App Security Engineer - SSDLC & CI/CD Defender

IntouchCX; Cebu City; On-site; PHP 1,200,000 - 1,800,000; Full time

Job summary

IntouchCX is seeking a Senior Application Security Specialist to assess and secure web-based, in-house apps and open-source telephony solutions. This role collaborates with the security analyst team to develop in-house tools for threat monitoring, vulnerability management, and security control administration.

You will conduct code reviews, automated scans, and manual testing, integrate SSDLC into CI/CD, and guide developers on secure development practices for client engagements.

Qualifications

• Bachelor’s degree or equivalent work experience in information security.
• Professional experience in application security assessments and pentesting.
• Knowledge of secure coding practices and OWASP guidelines.

Responsibilities

• Assess software for security vulnerabilities via code reviews, automated scanning, fuzzing, and manual inspection.
• Collaborate with development teams to identify security impacts and mitigations in sprint planning.
• Develop and manage tools to automate security testing (SAST, DAST, IAST).
• Provide security reviews in ticketed code-release workflows.
• Implement automated vulnerability scanning in CI/CD pipelines.
• Champion the SSDLC and communicate issues to Dev/Infra teams.

Skills

Code reviews

Vulnerability management

CI/CD security

Threat modeling

OWASP / secure coding

Security tooling

Education

Bachelor’s degree in Computer Science or related field

CISSP

C|ASE

GPEN

OSCP

Tools

Burp Suite

ZAP

SQLMap

SAST/DAST/IAST

Job description

IntouchCX is seeking a Senior Application Security Specialist to assess and secure web-based, in-house apps and open-source telephony solutions. This role collaborates with the security analyst team to develop in-house tools for threat monitoring, vulnerability management, and security control administration.

You will conduct code reviews, automated scans, and manual testing, integrate SSDLC into CI/CD, and guide developers on secure development practices for client engagements.