Senior Application Security Engineer (AU, Retail, Hybrid)

ConnectOS; Metro Manila; Hybrid; PHP 1,200,000 - 2,000,000; Full time

Benefits offered by this job

Hybrid Work

Medical & Dental

Paid Vacation & Sick Leave

Salary Appraisal

Financial Assistance

13th Month Pay

Fitness & Wellness Facilities

Company Events

Metro Manila Location

Job summary

ConnectOS in Metro Manila seeks an experienced Senior Application Security Engineer to embed security into software across CI/CD, cloud, and runtime. You will build tools, automate, and shift vulnerability detection left, collaborating with Engineering, Cloud, and Data teams.

You’ll own vulnerability management across apps, containers, and cloud, and define API security standards for external partners. Hybrid work 2–3 days onsite weekly.

Qualifications

• 5+ years in security engineering or application security roles, or equivalent software/platform engineering experience with a strong security focus.
• Deep hands-on experience building, securing, and integrating security tooling into CI/CD pipelines.
• Strong AWS knowledge across IAM, networking, compute, storage, and native security services.
• Practical experience with vulnerability management at scale, including triage, prioritisation, and remediation across diverse technology environments.
• Experience with application security tooling such as SAST, DAST, SCA, IaC scanning, container image scanning, and secrets detection.
• Understanding of OWASP Top 10, common web application vulnerabilities, and secure development principles.
• Demonstrated experience building custom tools, scripts, or automation rather than only configuring vendor products.
• Practical experience applying AI/ML or LLMs to security or engineering workflows, such as automated triage, code analysis, data enrichment, or agent-based automation.
• Strong communication skills, with the ability to explain technical risk to both engineers and non-technical stakeholders.

Responsibilities

• Design, build, and maintain security controls embedded in CI/CD pipelines.
• Build quality gates that provide fast, actionable feedback to developers without blocking delivery unnecessarily.
• Own the security tooling pipeline, including selection, integration, tuning, false-positive reduction, and developer experience.
• Develop and maintain security-as-code artefacts, including policies, rulesets, and custom checks that scale across repositories and teams.
• Work with engineering teams to shift vulnerability detection left, catching issues at commit and build rather than in production.
• Define and maintain API security standards, particularly for externally facing and partner-integrated services.
• Own the technical execution of vulnerability management across application, container, and cloud layers.
• Triage, prioritise, and drive remediation of vulnerabilities from sources such as Wiz, AWS Inspector, Defender, SAST, and DAST tools.
• Correlate vulnerability findings with asset context, including internet exposure, data sensitivity, identity permissions, and business criticality.
• Build and improve vulnerability reporting, metrics, and observability.
• Identify systemic root causes such as stale AMIs, unpatched base images, and outdated dependencies, and drive permanent fixes over one-off patches.
• Review and harden Infrastructure-as-Code, including Terraform and CloudFormation, for security misconfigurations before deployment.
• Contribute to AWS account baselining, onboarding, and security architecture patterns.
• Support penetration testing coordination, including scoping, remediation tracking, and retest validation.
• Provide practical security guidance to delivery teams during design, development, deployment, and operational support.

Skills

Security tooling

CI/CD integration

AWS knowledge

Vulnerability management

SAST/DAST/ SCA

IaC scanning

OWASP Top 10

Automation scripting

AI/ML in security

Communication skills

Tools

Terraform

CloudFormation

Docker

Kubernetes

SAST tools

Job description

Schedule: Monday to Friday (6am to 3pm PHT)

2-3x per week onsite

About The Role

The Senior Application Security Engineer is a hands-on, technically deep role that blends application security, DevSecOps, and cloud security engineering. The role embeds security directly into how software is built, deployed, and operated across client's technology estate. This role works horizontally across technologies such as CI/CD pipelines, cloud infrastructure, containers, APIs, and identity systems, and vertically through the stack from source code to runtime. The role is expected to build tools, automation, and scalable capabilities rather than only consuming vendor products. The role sits within the Cyber Security team and works closely with Application Development, Cloud, and Data teams. It is designed to act as a practical, approachable security partner to engineering squads, helping teams reduce risk without becoming a gatekeeper or unnecessarily slowing delivery.

What will you do?

• Design, build, and maintain security controls embedded in CI/CD pipelines.
• Build quality gates that provide fast, actionable feedback to developers without blocking delivery unnecessarily.
• Own the security tooling pipeline, including selection, integration, tuning, false-positive reduction, and developer experience.
• Develop and maintain security-as-code artefacts, including policies, rulesets, and custom checks that scale across repositories and teams.
• Work with engineering teams to shift vulnerability detection left, catching issues at commit and build rather than in production.
• Define and maintain API security standards, particularly for externally facing and partner-integrated services.
• Own the technical execution of vulnerability management across application, container, and cloud layers.
• Triage, prioritise, and drive remediation of vulnerabilities from sources such as Wiz, AWS Inspector, Defender, SAST, and DAST tools.
• Correlate vulnerability findings with asset context, including internet exposure, data sensitivity, identity permissions, and business criticality.
• Build and improve vulnerability reporting, metrics, and observability.
• Identify systemic root causes such as stale AMIs, unpatched base images, and outdated dependencies, and drive permanent fixes over one-off patches.
• Review and harden Infrastructure-as-Code, including Terraform and CloudFormation, for security misconfigurations before deployment.
• Contribute to AWS account baselining, onboarding, and security architecture patterns.
• Support penetration testing coordination, including scoping, remediation tracking, and retest validation.
• Provide practical security guidance to delivery teams during design, development, deployment, and operational support.

Who you are?

Required

• 5+ years in security engineering or application security roles, or equivalent software/platform engineering experience with a strong security focus.
• Deep hands-on experience building, securing, and integrating security tooling into CI/CD pipelines.
• Strong AWS knowledge across IAM, networking, compute, storage, and native security services.
• Practical experience with vulnerability management at scale, including triage, prioritisation, and remediation across diverse technology environments.
• Experience with application security tooling such as SAST, DAST, SCA, IaC scanning, container image scanning, and secrets detection.
• Understanding of OWASP Top 10, common web application vulnerabilities, and secure development principles.
• Demonstrated experience building custom tools, scripts, or automation rather than only configuring vendor products.
• Practical experience applying AI/ML or LLMs to security or engineering workflows, such as automated triage, code analysis, data enrichment, or agent-based automation.
• Strong communication skills, with the ability to explain technical risk to both engineers and non-technical stakeholders.

Desirable

• Familiarity with container, API, and cloud-native security, including Docker, Kubernetes/EKS, OAuth 2.0, OpenID Connect, and API gateway security.
• Experience building AI agents, RAG pipelines, or LLM-integrated tooling, with awareness of AI/ML security risks and mitigations.
• Familiarity with threat modelling and compliance frameworks such as STRIDE, PASTA, ISO 27001, PCI DSS, or SOC 2.

Join the awesome team and enjoy these benefits & perks

• Hybrid Work Arrangement
• Medical, Dental Coverage and Life insurance from day 1 of employment
• Paid Vacation and Sick Leave (with Quarterly Sick Leave Conversion)
• Competitive salary package and annual appraisal
• Financial Assistance Program
• Mandatory Government Benefits and 13th Month Pay
• Complimentary Sleeping Quarters, Coffee at no cost
• Complimentary Office Fitness and Wellness Facilities at no cost
• Regular Company Events, Work Life Balance, and Career growth opportunities
• Accessible location at the heart of Metro Manila --- the Mega Tower, EDSA

ConnectOS is certified as a Great Place to Work and is a top-rated Philippines employer of choice.

#ConnectOSCareers #JoinConnectOS #ConnectOSTech

Equal Employment Statement

Employment decisions at ConnectOS will be conducted without consideration of factors such as age', race, color, religion, gender, disability status, sexual orientation, gender identity or expression, genetic information, and marital status. ConnectOS ensures the full confidentiality of the data it processes.