6 months ago
Makati City, PhilippinesMid Level / Senior
Responsibilities
- Lead application security assessments using SAST, DAST, manual code reviews, and penetration testing.
- Conduct penetration testing across web applications, APIs, AI/ML systems, mobile applications, and desktop applications.
- Analyze OWASP Top 10 and advanced vulnerabilities including business logic flaws, broken access control, and insecure deserialization.
- Design, code, and deploy AI-powered automation tools and security scripts for vulnerability detection, threat triage, and testing efficiency.
- Build internal security tooling, integrations, and AI-assisted workflows.
- Conduct threat modeling and recommend security architecture improvements for complex, high-risk systems.
- Advise development and product teams on security-by-design and secure coding practices.
- Mentor associate security engineers and lead knowledge-sharing and technical discussions.
- Produce risk-rated vulnerability reports with actionable remediation guidance.
- Contribute to application security policies, standards, playbooks, and training materials.
- Monitor evolving threats and vulnerabilities in financial services and translate intelligence into security controls.
Requirements
- Requires 3–6 years of hands-on application security experience with ownership of security assessments and remediation cycles.
- Requires deep familiarity with OWASP Top 10, the OWASP Testing Guide, and OWASP Application Security Verification Standard.
- Requires penetration testing experience for web applications, APIs, AI/ML systems, mobile applications, and desktop applications.
- Requires experience with tools such as Burp Suite Pro, OWASP ZAP, or Metasploit.
- Requires the ability to build AI-powered security automation tools and integrations using Python, JavaScript, or similar languages.
- Requires experience with AI/ML APIs or LLM-based tools for security workflow automation.
- Requires threat modeling and mobile penetration testing experience.
- Requires leadership, communication, stakeholder-influence, and risk-reporting skills.
- Preferred qualifications include OSCP, GWAPT, eWPT, CSSLP, CISSP, or equivalent certifications.
- Preferred qualifications include banking, insurance, or financial services experience and knowledge of PCI-DSS, BSP regulations, ISO 27001, or SOC 2.
- Preferred qualifications include cloud security experience with AWS, Azure, or GCP and knowledge of cloud-native application security controls.
- Preferred qualifications include iOS and Android application security testing, STRIDE or PASTA threat modeling, red-team or bug-bounty exposure, and experience leading security initiatives.
Benefits
- Flexible hybrid working arrangement.
- Opportunities to learn, grow, and shape one’s career.
- Supportive environment focused on well-being, inclusion, and professional development.
- Equal opportunity employer with reasonable accommodation support during the application process.
Tech Stack
Categories
About Manulife
Manulife is a Toronto‑headquartered public financial services company that provides life and health insurance, retirement plans, and wealth and asset management to individuals and institutions. It earns premiums and fee income from insurance, investment, and advisory products delivered across Canada, Asia, and Europe, and operates as John Hancock in the United States. Founded in 1887, the company is listed on the Toronto Stock Exchange.