2 months ago
Quezon City, PhilippinesMid Level
Responsibilities
- Perform final quality reviews of penetration testing reports, validating technical accuracy, scope, evidence, exploitability, impact, duplicates, false positives, and risk ratings.
- Review and calibrate severity using CVSS, exploitability, asset criticality, business impact, environmental context, and compensating controls.
- Work with penetration testers to address documentation, methodology, coverage, assumptions, limitations, and conclusion gaps before reports are issued.
- Provide risk-based remediation guidance and help application teams understand corrective actions and closure evidence.
- Track findings and remediation dates, coordinate retesting, validate corrective actions, and document closure decisions or residual risks.
- Triage emerging vulnerabilities and determine relevance, exposure, validation needs, and escalation paths.
- Support Burp Suite and Snyk administration, scan configuration, issue triage, troubleshooting, scheduling, reporting, and platform coordination.
- Maintain quality standards, checklists, templates, procedures, status updates, and quality metrics while recommending process improvements.
Requirements
- Bachelor’s degree in Computer Science, Computer Engineering, Information Technology, Cybersecurity, or a related field, or equivalent practical experience.
- At least three years of relevant experience in penetration testing, application security, vulnerability assessment, vulnerability management, or security quality assurance.
- Hands-on experience reviewing penetration test reports, validating evidence, assessing exploitability and business impact, challenging severity ratings, and confirming remediation through retesting.
- Strong knowledge of web application and API security, common attack techniques, authentication and authorization weaknesses, OWASP testing practices, CVSS, CWE, and vulnerability classification.
- Practical experience with Burp Suite Professional or comparable web and API security testing tools.
- Working knowledge of SAST, DAST, SCA, open-source vulnerability management, DevSecOps pipelines, and the vulnerability management lifecycle.
- Clear written and verbal communication skills, analytical judgment, attention to detail, prioritization, and ability to work with globally distributed teams.
- Preferred experience includes penetration testing or review across web applications, APIs, mobile applications, cloud environments, or networks; regulated-industry application security; OWASP WSTG, PTES, or NIST SP 800-115; vulnerability-management platforms; Snyk administration; scripting; and relevant security certifications such as OSCP, OSWE, CREST CCT/CRT, GIAC GWAPT/GPEN, or CompTIA PenTest+.
Benefits
- Hybrid work arrangement at UP Ayala Technohub, Quezon City, with three onsite days per week.
- Fixed late mid-shift or night-shift schedule based on business requirements.
- Learning and career-development support in a flexible, inclusive environment.
- Equal opportunity employment and reasonable accommodation support.
About Manulife
Manulife is a Toronto‑headquartered public financial services company that provides life and health insurance, retirement plans, and wealth and asset management to individuals and institutions. It earns premiums and fee income from insurance, investment, and advisory products delivered across Canada, Asia, and Europe, and operates as John Hancock in the United States. Founded in 1887, the company is listed on the Toronto Stock Exchange.