Senior Application Security Engineer - Hybrid DevSecOps

ConnectOS; Metro Manila; Hybrid; PHP 1,400,000 - 2,100,000; Full time

Benefits offered by this job

Hybrid work arrangement

Medical and dental coverage from day 1

Paid vacation and sick leave

13th month pay and wellness facilities

Career growth opportunities

Regular company events

Central Metro Manila location

Job summary

ConnectOS is seeking a Senior Application Security Engineer to embed security into software across Flybuys’ tech estate. You’ll design and maintain security controls in CI/CD, shift left vulnerability detection, and own tooling pipelines while collaborating with Development, Cloud, and Data teams.

You will build custom automation, define API security standards, and drive remediation for vulnerabilities from multiple sources. A hybrid work setup in Metro Manila supports flexible delivery.

Qualifications

• 5+ years in security engineering or application security roles.
• Deep hands-on experience building and integrating security tooling into CI/CD pipelines.
• Strong AWS knowledge across IAM, networking, compute, storage and native security services.
• Practical experience with vulnerability management at scale across diverse environments.
• Experience with SAST/DAST/SCA, IaC scanning, container image scanning, and secrets detection.
• Understanding of OWASP Top 10 and secure development practices.
• Experience building custom tools and automation rather than only configuring vendor products.
• Experience applying AI/ML or LLMs to security workflows.

Responsibilities

• Design, build, and maintain security controls embedded in CI/CD pipelines.
• Build quality gates that provide fast, actionable feedback to developers without blocking delivery.
• Own the security tooling pipeline, including selection, integration, tuning, false-positive reduction, and developer experience.
• Develop and maintain security-as-code artefacts, including policies, rulesets, and custom checks.
• Shift vulnerability detection left, catching issues at commit and build rather than in production.
• Define and maintain API security standards for externally facing services.
• Own vulnerability management across application, container, and cloud layers.
• Triage, prioritise, and drive remediation of vulnerabilities from Wiz, AWS Inspector, Defender, SAST, DAST.
• Correlate vulnerability findings with asset context (exposure, data sensitivity, identity, business criticality).
• Build and improve vulnerability reporting, metrics, and observability.
• Identify systemic root causes and drive permanent fixes over one-off patches.
• Review and harden Infrastructure-as-Code (Terraform, CloudFormation) before deployment.
• Contribute to AWS account baselining, onboarding, and security patterns.
• Support penetration testing coordination and remediation tracking.
• Provide practical security guidance to delivery teams across stages.

Skills

5+ years exp

Security tooling integration

AWS security

Vulnerability management at scale

SAST/DAST/SCA

IaC scanning

Container image scanning

Secrets detection

AI/ML in security workflows

Strong communication

Tools

SAST

DAST

SCA

IaC scanning

Container scanning

Terraform

CloudFormation

AWS Inspector

Job description

ConnectOS is seeking a Senior Application Security Engineer to embed security into software across Flybuys’ tech estate. You’ll design and maintain security controls in CI/CD, shift left vulnerability detection, and own tooling pipelines while collaborating with Development, Cloud, and Data teams.

You will build custom automation, define API security standards, and drive remediation for vulnerabilities from multiple sources. A hybrid work setup in Metro Manila supports flexible delivery.