2 months ago
Quezon City, PhilippinesSenior
Responsibilities
- Lead threat modeling engagements for applications, APIs, cloud services, third-party integrations, and significant technology changes.
- Define and document system scope, components, assets, data flows, entry points, trust boundaries, dependencies, and assumptions with engineering and architecture teams.
- Select and apply appropriate threat modeling methods, including STRIDE, attack trees, abuse cases, PASTA, and LINDDUN.
- Assess threats, document defensible risk decisions, and translate findings into security requirements, design recommendations, test criteria, and remediation actions.
- Track mitigations through closure or formal risk acceptance and provide governance and quality oversight for threat modeling deliverables.
- Embed threat modeling into architecture reviews, agile delivery, change management, security testing, penetration testing, and Secure SDLC activities.
- Maintain standards, templates, threat libraries, secure design patterns, and reusable mitigation guidance while identifying automation and self-service opportunities.
- Coach delivery teams, review threat model quality and coverage, and communicate outcomes, exceptions, trends, and measurable risk reduction.
- Produce service metrics and reporting covering delivery performance, adoption, quality, mitigation follow-through, and risk reduction.
Requirements
- Bachelor’s degree in Computer Science, Software Engineering, Information Technology, Cybersecurity, or a related field, or equivalent practical experience.
- At least five years of relevant experience across threat modeling, application security, security architecture, secure software development, cloud security, or a related discipline.
- Experience leading collaborative threat modeling or secure design reviews for applications, APIs, cloud-native systems, distributed architectures, or third-party integrations.
- Ability to analyze architectures and data flows, identify trust boundaries and attack paths, prioritize material threats, and translate findings into testable requirements and practical mitigations.
- Practical knowledge of at least one established threat modeling method, such as STRIDE, attack trees, abuse cases, PASTA, or LINDDUN.
- Working knowledge of application and API security, identity and access management, data protection, cloud and network architecture, containers, distributed systems, and common attack techniques.
- Familiarity with OWASP guidance, MITRE ATT&CK, and the NIST Secure Software Development Framework.
- Experience incorporating threat modeling into architecture governance, Secure SDLC activities, security testing, penetration testing, remediation, and risk acceptance processes.
- Strong analytical, facilitation, technical-writing, and stakeholder-management skills, with the ability to work independently and communicate risk clearly.
- Preferred experience with enterprise threat modeling, application security, product security, or security architecture programs, particularly in regulated industries.
- Preferred experience assessing Microsoft Azure, AWS, Google Cloud, Kubernetes, microservices, event-driven systems, APIs, mobile applications, or AI-enabled solutions.
- Preferred experience creating reusable threat libraries, reference threat models, secure design patterns, architecture decision records, or mitigation guidance.
- Preferred experience with Microsoft Threat Modeling Tool, OWASP Threat Dragon, IriusRisk, pytm, Visio, or comparable tools.
- Preferred knowledge of privacy threat modeling, software supply-chain risks, AI and agentic-system risks, cloud shared-responsibility models, or emerging attack techniques.
- Relevant security or architecture certifications such as ISC2 CSSLP, CISSP, Microsoft Azure Security Engineer Associate, GIAC Defensible Security Architecture, SABSA, or TOGAF are preferred.
Benefits
- Hybrid arrangement at UP Ayala Technohub, Quezon City, with three onsite days per week.
- Fixed late mid-shift or night-shift schedule based on business requirements.
- Learning, career growth, well-being, inclusion, and flexible work environment support.
- Equal opportunity employer with reasonable accommodation support during recruitment.
Tech Stack
Categories
About Manulife
Manulife is a Toronto‑headquartered public financial services company that provides life and health insurance, retirement plans, and wealth and asset management to individuals and institutions. It earns premiums and fee income from insurance, investment, and advisory products delivered across Canada, Asia, and Europe, and operates as John Hancock in the United States. Founded in 1887, the company is listed on the Toronto Stock Exchange.