Application Security Engineer - Penetration Testing QA

About the role

Manulife is looking for an experienced Application Security Engineer to act as the quality-assurance point for penetration testing deliverables across applications and APIs. This individual-contributor role reviews reports and findings before release, confirms that risk ratings and evidence are sound, and helps application teams move findings through remediation and closure. The position is based at UP Ayala Technohub in Quezon City.

Key responsibilities

• Review penetration test reports before release, checking accuracy, reproducibility, evidence, scope and clarity for technical and business audiences
• Validate affected assets, exploitation paths, business impact, duplicates and false positives, and challenge conclusions that lack evidence
• Calibrate severity ratings using CVSS, exploitability, asset criticality, business impact, context and compensating controls
• Confirm scope, methodology, coverage, assumptions and limitations are complete, and work with testers to close gaps
• Provide risk-based remediation guidance and track open findings, retesting and closure
• Triage new vulnerabilities and support Burp Suite and Snyk operations, including scans, issue triage and reporting
• Maintain quality standards, checklists and templates, and produce status updates and quality metrics

Required profile

• Bachelor's degree in a computing or cybersecurity field, or equivalent practical experience
• At least three years of experience in penetration testing, application security, vulnerability assessment, vulnerability management or security QA
• Hands-on experience reviewing penetration test reports and validating evidence
• Clear written and verbal communication, and ability to work with globally distributed teams
• Amenable to a hybrid arrangement (three onsite days per week) and to a late mid-shift or night-shift schedule

Required skills

• Web and API security, OWASP testing practices, CVSS, CWE and vulnerability classification
• Burp Suite Professional or comparable tools
• Working knowledge of SAST, DAST, SCA, DevSecOps pipelines and vulnerability management
• Preferred: Snyk administration, OWASP WSTG/PTES/NIST SP 800-115, issue-tracking platforms, and scripting (Python, PowerShell, Unix shell, VBA)