Senior Application Security Engineer – Java / .NET | Up to PHP 170K

Private Advertiser; Metro Manila; Hybrid; PHP 1,726,000 - 2,068,000; Full time

Job summary

Private Advertiser is seeking an experienced Senior Application Security Engineer to strengthen application security across the software development lifecycle. This is a hands‑on, technical role focused on identifying and addressing vulnerabilities, integrating security into development processes, and ensuring secure design, development, and deployment.

The ideal candidate has a strong background in end‑to‑end application security, with development experience in Java or C#/.NET.

Qualifications

• 8+ years combined software development and application security experience.
• 3+ years hands-on, end-to-end application security across SDLC.
• Strong background in Java and/or C#/.NET development.
• Experience with SAST, DAST, SCA and secret scanning tools.

Responsibilities

• Manage app security across the SDLC from design to deployment.
• Implement, configure, and maintain SAST/DAST/SCA and secret scanning.
• Integrate automated security scanning and gates into CI/CD pipelines.
• Identify, assess, prioritize, and track vulnerabilities through remediation and verification.
• Conduct threat modeling, security architecture reviews, and secure code reviews.
• Collaborate with developers to resolve security issues and promote secure coding practices.
• Strengthen Azure cloud security controls and related authentication/identity management implementations.
• Coordinate penetration testing activities and ensure remediation.
• Promote OWASP best practices and secure development standards.
• Support security incident investigations and remediation activities.
• Assess AI/LLM application security risks.

Skills

End-to-end App Sec

Java

C#/.NET

CI/CD Integration

Azure DevOps

OWASP Top 10

Threat Modeling

Azure Cloud/Security

Tools

Fortify

Veracode

Checkmarx

SonarQube

Burp Suite

Job description

Location: Metro Manila
Work Setup: Hybrid – Onsite twice a month
Schedule: Monday to Friday | Day Shift
Salary: Up to PHP 170,000/month, depending on experience

About the Role

We are looking for an experienced Senior Application Security Engineer to strengthen application security across our software development lifecycle.

This is a hands‑on technical role focused on identifying and addressing application vulnerabilities, integrating security practices into development processes, and ensuring applications are designed, developed, and deployed securely.

The ideal candidate has a strong background in end-to-end application security, combined with software development experience in Java or C#/.NET.

Key Responsibilities

• Manage application security activities throughout the software development lifecycle (SDLC), from design and development through testing, deployment, and ongoing maintenance.

• Implement, configure, and maintain security testing tools, including SAST, DAST, SCA, and secret scanning.

• Integrate automated security scanning and security gates into CI/CD pipelines.

• Identify, assess, prioritize, and track application vulnerabilities through remediation and verification.

• Conduct threat modeling, security architecture reviews, and secure code reviews.

• Collaborate with software developers to resolve security vulnerabilities and implement secure coding practices.

• Strengthen application and cloud security controls within Microsoft Azure.

• Review authentication, authorization, API security, identity management, and secrets management implementations.

• Coordinate penetration testing activities and ensure identified vulnerabilities are properly addressed.

• Establish and promote secure development standards, including OWASP best practices.

• Support application security incident investigations and remediation activities.

• Assess emerging application security risks, including those associated with AI‑enabled applications and integrations.

Qualifications

• At least 8 years of combined experience in software development and application security.

• At least 3 years of hands‑on, end‑to‑end application security experience, covering multiple stages of the secure software development lifecycle.

• Strong software development background using Java and/or C#/.NET.

• Hands‑on experience implementing and managing application security testing tools, including:

  • SAST – Static Application Security Testing

  • DAST – Dynamic Application Security Testing

  • SCA – Software Composition Analysis

  • Secret scanning and vulnerability management tools

• Experience integrating security testing into CI/CD pipelines, preferably using Azure DevOps or similar platforms.

• Strong knowledge of OWASP Top 10, API security, common application vulnerabilities, and secure coding practices.

• Experience with threat modeling, vulnerability assessment, security code reviews, and remediation management.

• Practical experience working with Microsoft Azure environments and cloud security controls.

• Familiarity with authentication and authorization technologies such as OAuth 2.0, OpenID Connect, Microsoft Entra ID, or Auth0.

• Ability to work independently and collaborate effectively with software engineering, DevOps, and security teams.

Nice to Have

• Experience with Fortify, Veracode, Checkmarx, SonarQube, Burp Suite, or similar security tools.

• Experience with Microsoft Defender for Cloud, Azure Key Vault, and cloud identity management.

• Knowledge of Python or security automation scripting.

• Exposure to AI/LLM application security, including prompt injection and data leakage risks.

• Relevant application security or cloud security certifications.