Senior DevSecOps Security Engineer (SAST, DAST, SCA)

Hammerjack Pty Ltd; Philippines; On-site; PHP 1,500,000 - 2,300,000; Full time

Job summary

Hammerjack Pty Ltd is seeking an experienced Application Security Engineer to embed security across the SDLC, focusing on DevSecOps, security automation, code scanning, security testing, and cloud security. You will work with security, architecture, and engineering teams to shift security left through scalable, self-service practices aligned with industry standards.

The role involves designing secure CI/CD pipelines, implementing security tools, and driving secure coding practices while enabling

Qualifications

• 8–12 years of technology experience with 5+ years in Application Security/DevSecOps.
• Hands-on experience designing and operating DevSecOps pipelines with SAST, DAST, SCA, secrets detection, container scanning, and SBOM.
• Experience with enterprise security tools such as GitHub Advanced Security, Checkmarx, Snyk, Trivy, OWASP ZAP.
• Strong knowledge of Azure cloud security including IAM, Key Vault, network security, containers/Kubernetes, and IaC.
• Strong understanding of OWASP Top 10, NIST, secure coding, and vulnerability management.

Responsibilities

• Design, build, and maintain secure CI/CD pipelines integrating SAST, DAST, SCA, secrets detection, container scanning, and SBOM generation.
• Implement and optimize security tools such as GitHub Advanced Security, Checkmarx, Snyk, Trivy, OWASP ZAP, or equivalent.
• Develop security standards, guardrails, and reusable pipeline templates for engineering teams.
• Lead security testing for applications, including SAST, DAST, API security testing, and penetration testing support.
• Triage, prioritize, and track vulnerabilities while providing remediation guidance to engineering teams.
• Coordinate remediation and response with engineering and platform teams.
• Conduct security awareness sessions, code review workshops, and threat modeling walkthroughs.

Skills

DevSecOps pipelines

Security automation

Threat modeling

Security testing

Cloud security

Tools

GitHub Advanced Security

Checkmarx

Snyk

Trivy

OWASP ZAP

SBOM generation

Job description

Hammerjack Pty Ltd is seeking an experienced Application Security Engineer to embed security across the SDLC, focusing on DevSecOps, security automation, code scanning, security testing, and cloud security. You will work with security, architecture, and engineering teams to shift security left through scalable, self-service practices aligned with industry standards.

The role involves designing secure CI/CD pipelines, implementing security tools, and driving secure coding practices while enabling