Senior Engineer Application Security

Cebu Pacific Air; Pasay; Hybrid; PHP 1,200,000 - 1,800,000; Full time

Benefits offered by this job

Free travel for you and your family

Comprehensive healthcare coverage

Learning programs and leadership dev

Job summary

Cebu Pacific Digital & Technology Office in Pasay City seeks a Senior Engineer, Application Security to lead WAF/WAAP and perimeter security for internet-facing apps and APIs. You will analyze HTTP/S traffic, configure security controls, and coordinate vulnerability assessments in a hybrid work environment.

The role emphasizes secure software development practices, incident response, and collaboration with engineering, SRE, and operations to continuously improve security posture.

Qualifications

• Bachelor’s degree in Computer Science, Information Security, Engineering, or related field.
• 5–10 years of experience in cybersecurity, with strong focus on application security.
• Experience deploying vulnerability assessment tools and remediation programs.
• Experience with cloud security controls on AWS, Azure, or GCP.

Responsibilities

• WAF, Perimeter Security Engineering & Threat Analysis.
• Administer, configure, and optimize WAF/WAAP and perimeter security for internet-facing apps and APIs.
• Manage security policies, rules, exceptions, and mitigations for emerging threats.
• Analyze HTTP/S traffic and WAF events to identify attacks and anomalies.
• Validate attacks and false positives; perform root-cause analysis and tuning.
• Configure edge security capabilities including CDN, bot mitigation, IP reputation, and API protections.
• Manage SSL/TLS certificates and secure configurations across edge and origin.
• Support security onboarding, testing, and production deployments for apps.
• Evaluate security control effectiveness using threats and metrics to drive improvements.
• Coordinate vulnerability assessments, PIA testing, remediation tracking, and retesting.
• Establish application security standards and remediation workflows.

Skills

WAF security

Perimeter security engineering

Threat analysis

HTTP/S traffic analysis

Software security

Security incident response

Vendor management

Education

Bachelor’s degree in Computer Science, Information Security, Engineering, or related field

Tools

CISSP

CSSLP

CISM

CEH

GIAC

Job description

Job Description:

Department

Digital & Technology Office

Employee Type

Regular

At Cebu Pacific, we embrace challenges head-on, staying at the forefront of innovation through agile technology, data-driven insights, and a relentless focus on customer and operational excellence. A career with our Digital Team offers you the opportunity to shape the future of air travel—whether by developing cutting‑edge digital products, harnessing the power of analytics, or driving impactful projects that enhance passenger experiences and streamline operations. We don’t just build technology—we create experiences and innovations that inspire and redefine the future of travel. Be part of this exciting journey and let your expertise take flight as a moment maker in the ever evolving field of Digital as a Senior Engineer, Application Security.

Primary Responsibilities

• WAF, Perimeter Security Engineering & Threat Analysis


• Administer, configure, and optimize WAF/WAAP and associated perimeter security controls protecting internet-facing applications and APIs.


• Manage security policies, custom rules, exceptions, and mitigation configurations to address emerging threats and application‑specific requirements.


• Analyze HTTP/S traffic, WAF events, and application‑layer attack patterns to investigate threats such as SQL injection, cross‑site scripting, malicious scanning, automated abuse, and suspicious API activity.


• Validate suspected attacks and false positives, perform root‑cause analysis, and implement evidence‑based tuning and mitigation measures while maintaining legitimate application traffic.


• Configure and optimize edge security capabilities, including CDN delivery settings, origin protection, bot mitigation, IP reputation controls, and API security protections, where applicable.


• Manage and troubleshoot SSL/TLS certificates and configurations, including certificate provisioning, renewal, expiration monitoring, certificate chain validation, and secure TLS configuration across edge and origin connections.


• Support security onboarding, configuration changes, testing, and production deployments for new and existing applications.


• Evaluate security control effectiveness using threat trends, mitigation results, false‑positive rates, and other relevant operational metrics to identify and implement continuous improvements.


• Application Security Engineering


• Operate and enhance application security testing capabilities, including Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and other supported security scanning technologies.


• Coordinate vulnerability assessments and penetration testing activities, including scope definition, findings validation, remediation tracking, and retesting.


• Assess application security findings and prioritize remediation based on risk, exploitability, and exposure, collaborating with development teams to address identified weaknesses.


• Establish and maintain application security standards, testing requirements, vulnerability remediation workflows, and security assessment procedures.


• Support secure software development practices and the integration of application security testing into development and release processes.


• Evaluate opportunities to strengthen application protection through application hardening, code obfuscation, and related security controls, where appropriate.


• Contribute to the standardization, consolidation, and continuous improvement of application security tools and processes.


• Security Governance & Operational Sustainability


• Develop and maintain security configuration standards, technical documentation, operational procedures, and incident handling runbooks.


• Establish consistent processes for security policy changes, exception management, application onboarding, testing, approvals, and production implementation.


• Coordinate with SRE, infrastructure, application support, development teams, and external technology providers to maintain effective security operations.


• Support the transition of security services into sustainable operational ownership through knowledge transfer, documentation, defined responsibilities, and escalation procedures.


• Assess security control coverage, identify control gaps, and support audit and compliance requirements through appropriate technical evidence and documentation.


• Evaluate security technologies and operational processes to identify practical improvements aligned with security requirements, operational feasibility, and business priorities.

Qualifications

• Bachelor’s degree in Computer Science, Information Security, Engineering, or related field.


• Relevant certifications preferred (e.g., CISSP, CSSLP, CISM, CEH, GIAC, or equivalent)


• 5–10 years of experience in cybersecurity, with strong focus on application security.


• Strong understanding of modern application architectures (APIs, microservices, cloud‑native, containers).


• Experience in deploying vulnerability assessment tools and remediation programs.


• Experience in deploying and managing cloud platforms (AWS, Azure, or GCP) security controls and services preferred.


• Experience in cybersecurity, application security, WAF engineering, perimeter security, or security operations.


• Hands‑on experience administering and optimizing enterprise WAF/WAAP or comparable application‑layer security technologies. Preferably Akamai.


• Strong understanding of web application and API architectures, HTTP/S traffic, common web vulnerabilities, and attack mitigation techniques.


• Experience with application security testing tools, vulnerability management, and penetration testing activities.


• Ability to investigate complex security events, analyze technical evidence, and develop effective mitigation strategies.


• Experience working with application development, infrastructure, SRE, and operations teams to implement and sustain security controls.


• Strong analytical, problem‑solving, technical documentation, and stakeholder communication skills.


• Experience with vendor management.

Why Join Us

• We are the first Great Place to Work ® certified airline in Southeast Asia.


• We have been recognized as Best Employer Brand on LinkedIn for two consecutive years.


• Be part of a forward‑thinking team that values innovation and continuous improvement.


• Play a key role in developing and nurturing the talents that drive our success.


• Accelerate your career with access to extensive learning programs and leadership development initiatives, all under Ceb U, our corporate university.


• Enjoy unique employee perks such as free travel for you and your family. Expanded coverage to common law partners and same sex partners!


• Be assured of a comprehensive healthcare coverage upon hire.

Note: This position is for an Individual Contributor and will be based in Pasay City, Metro Manila but currently follows a hybrid workplace flexibility arrangement.

Your moment matters. Be a Moment Maker!

Experience Range Range (Years)

4 - 8 years

Job posted on 2026-10-23