Senior Application Security QA & Pen Test Reviewer

Manulife/John Hancock; Quezon City; Hybrid; PHP 1,000,000 - 1,500,000; Full time

Job summary

Manulife/John Hancock is seeking an experienced Application Security Engineer in a hands-on, individual-contributor role. You will approve penetration test deliverables, validate evidence, and guide remediation with stakeholders.

You will also support Burp Suite and Snyk operations and help improve testing quality and reporting standards. The role requires 3+ years in security testing, a CS/CE/IT degree, and strong communication to explain risk to technical and business audiences within a hybrid

Qualifications

• Bachelor's degree in Computer Science, Engineering, IT, or related field or equivalent practical experience.
• 3+ years in penetration testing, application security, vulnerability assessment or security QA.
• Experience reviewing penetration test reports with evidence and remediation validation.

Responsibilities

• Perform final quality reviews of penetration test reports before release.
• Validate risk ratings, evidence, scope, and remediation actions.
• Calibrate severity using CVSS, asset criticality and business impact.
• Provide remediation guidance and track open findings to closure.
• Triage vulnerabilities and support Burp Suite and Snyk operations.
• Maintain quality standards, templates, and operating procedures.

Skills

Penetration testing

Application security

CVSS understanding

Evidence-based decisions

Communication skills

Education

Bachelor's degree in CS/CE/IT

Tools

Burp Suite

Snyk

Job description

Manulife/John Hancock is seeking an experienced Application Security Engineer in a hands-on, individual-contributor role. You will approve penetration test deliverables, validate evidence, and guide remediation with stakeholders.

You will also support Burp Suite and Snyk operations and help improve testing quality and reporting standards. The role requires 3+ years in security testing, a CS/CE/IT degree, and strong communication to explain risk to technical and business audiences within a hybrid