6 days ago
Makati City, PhilippinesSenior
Responsibilities
- Drive adoption of enterprise application security standards across applications, platforms, and cloud environments.
- Automate vulnerability detection, remediation, exception review, and reporting workflows.
- Provide risk-based technical guidance and training to developers on secure design and coding standards.
- Partner with architects, product owners, and development teams to embed secure-by-design principles.
- Conduct and validate automated and manual application security testing, including findings from penetration tests and bug bounty programs.
- Manage vulnerability triage, exception review, remediation prioritization, risk treatment, and reporting.
- Conduct application- and architecture-level threat modeling for new applications, major enhancements, and high-risk changes.
- Define threat modeling templates, playbooks, and reusable threat libraries.
- Support remediation workstreams for secrets, SCA, SAST, and DAST vulnerabilities.
- Integrate security expectations into CI/CD pipelines and DevSecOps workflows.
- Partner with Global Application Security, CIO, engineering, architecture, and Vulnerability Management teams on standards, tooling, accountability, and continuous improvement.
- Support audit, regulatory, and control assurance activities.
Requirements
- At least 5 years of experience in application security or software development focused on secure coding and DevSecOps.
- Strong understanding of application security principles, the SDLC, and CI/CD pipelines.
- Strong understanding of application penetration testing.
- Knowledge of secure coding standards and frameworks such as OWASP Top 10 and NIST.
- Excellent collaboration and communication skills for engaging developers and stakeholders.
- Hands-on experience with security tools and automation frameworks, including Secrets, SCA, SAST, container security, and DAST.
- Familiarity with cloud-native application security concepts.
- Practical exposure to API security, Kubernetes, container platforms, Infrastructure as Code, hybrid cloud environments, and penetration testing or vulnerability scanning toolchains.
- OSCP, CISSP, or an equivalent certification preferred; OSWP, GIAC GWAPT, and INE eWPTX are advantageous.
- Experience with complementary application-layer controls such as WAF and NAC is advantageous.
Benefits
- Flexible hybrid working arrangement.
- Opportunities to learn, grow, and shape a desired career.
- Supportive environment emphasizing well-being, inclusion, and professional development.
- Equal opportunity employment and reasonable accommodation support.
Tech Stack
Categories
About Manulife
Manulife is a Toronto‑headquartered public financial services company that provides life and health insurance, retirement plans, and wealth and asset management to individuals and institutions. It earns premiums and fee income from insurance, investment, and advisory products delivered across Canada, Asia, and Europe, and operates as John Hancock in the United States. Founded in 1887, the company is listed on the Toronto Stock Exchange.