Senior AppSec Engineer: Build Secure DevOps & Pipelines

ConnectOS; Metro Manila; Hybrid; PHP 1,200,000 - 2,000,000; Full time

Benefits offered by this job

Hybrid Work

Medical & Dental

Paid Vacation & Sick Leave

Salary Appraisal

Financial Assistance

13th Month Pay

Fitness & Wellness Facilities

Company Events

Metro Manila Location

Job summary

ConnectOS in Metro Manila seeks an experienced Senior Application Security Engineer to embed security into software across CI/CD, cloud, and runtime. You will build tools, automate, and shift vulnerability detection left, collaborating with Engineering, Cloud, and Data teams.

You’ll own vulnerability management across apps, containers, and cloud, and define API security standards for external partners. Hybrid work 2–3 days onsite weekly.

Qualifications

• 5+ years in security engineering or application security roles, or equivalent software/platform engineering experience with a strong security focus.
• Deep hands-on experience building, securing, and integrating security tooling into CI/CD pipelines.
• Strong AWS knowledge across IAM, networking, compute, storage, and native security services.
• Practical experience with vulnerability management at scale, including triage, prioritisation, and remediation across diverse technology environments.
• Experience with application security tooling such as SAST, DAST, SCA, IaC scanning, container image scanning, and secrets detection.
• Understanding of OWASP Top 10, common web application vulnerabilities, and secure development principles.
• Demonstrated experience building custom tools, scripts, or automation rather than only configuring vendor products.
• Practical experience applying AI/ML or LLMs to security or engineering workflows, such as automated triage, code analysis, data enrichment, or agent-based automation.
• Strong communication skills, with the ability to explain technical risk to both engineers and non-technical stakeholders.

Responsibilities

• Design, build, and maintain security controls embedded in CI/CD pipelines.
• Build quality gates that provide fast, actionable feedback to developers without blocking delivery unnecessarily.
• Own the security tooling pipeline, including selection, integration, tuning, false-positive reduction, and developer experience.
• Develop and maintain security-as-code artefacts, including policies, rulesets, and custom checks that scale across repositories and teams.
• Work with engineering teams to shift vulnerability detection left, catching issues at commit and build rather than in production.
• Define and maintain API security standards, particularly for externally facing and partner-integrated services.
• Own the technical execution of vulnerability management across application, container, and cloud layers.
• Triage, prioritise, and drive remediation of vulnerabilities from sources such as Wiz, AWS Inspector, Defender, SAST, and DAST tools.
• Correlate vulnerability findings with asset context, including internet exposure, data sensitivity, identity permissions, and business criticality.
• Build and improve vulnerability reporting, metrics, and observability.
• Identify systemic root causes such as stale AMIs, unpatched base images, and outdated dependencies, and drive permanent fixes over one-off patches.
• Review and harden Infrastructure-as-Code, including Terraform and CloudFormation, for security misconfigurations before deployment.
• Contribute to AWS account baselining, onboarding, and security architecture patterns.
• Support penetration testing coordination, including scoping, remediation tracking, and retest validation.
• Provide practical security guidance to delivery teams during design, development, deployment, and operational support.

Skills

Security tooling

CI/CD integration

AWS knowledge

Vulnerability management

SAST/DAST/ SCA

IaC scanning

OWASP Top 10

Automation scripting

AI/ML in security

Communication skills

Tools

Terraform

CloudFormation

Docker

Kubernetes

SAST tools

Job description

ConnectOS in Metro Manila seeks an experienced Senior Application Security Engineer to embed security into software across CI/CD, cloud, and runtime. You will build tools, automate, and shift vulnerability detection left, collaborating with Engineering, Cloud, and Data teams.

You’ll own vulnerability management across apps, containers, and cloud, and define API security standards for external partners. Hybrid work 2–3 days onsite weekly.