Application Security Engineer (Secure Development / Secrets Management)

About the role

Manulife is looking for an Application Security Engineer to join the Global Cybersecurity Services (GCS) Application Security Rapid Lab Team in Quezon City. You will partner with Application Security teams, developers and business stakeholders to advance enterprise secrets remediation and secure software development. The role combines software engineering fundamentals with hands-on application security experience, and involves communicating remediation strategies and architecture decisions clearly.

Key responsibilities

• Assess applications for hard-coded secrets, credentials, certificates, API keys and configuration risks, and support secure migration to Azure Key Vault, HashiCorp Vault or equivalent platforms
• Design, develop and maintain secure backend services, APIs, reusable components and utilities using Java, Python, C# or equivalent, applying secure-by-design and Secure SDLC principles
• Contribute to automation and automated remediation, and integrate security controls into CI/CD pipelines
• Analyze and prioritize findings from SAST, DAST, SCA, secrets scanning, penetration testing and code reviews, and support risk-based remediation
• Take part in architecture reviews, recommend secure patterns and address root causes of recurring risks
• Communicate security risks, trade-offs and remediation plans to technical and non-technical stakeholders across global teams

Required profile

• Bachelor's degree in Computer Science, Software Engineering, Computer Engineering, Information Technology, Cybersecurity or a related field
• Minimum five years of software engineering experience, including secure application development and vulnerability remediation
• Proven experience building backend applications, APIs, reusable components, automation utilities and security-focused tools
• Hands-on experience with Secure SDLC and secure coding across design, development, testing, deployment and maintenance
• Experience triaging and remediating findings from SAST, DAST, SCA, secrets scanning, penetration testing and code reviews
• Ability to explain technical designs, architecture decisions and security trade-offs
• Amenable to a hybrid setup at UP Ayala Technohub, Quezon City (three days a week), and to a fixed late mid-shift or night-shift schedule

Required skills

• Java, Python, C# or equivalent; object-oriented programming and design patterns
• Secrets management and credential lifecycle management with Azure Key Vault, HashiCorp Vault or equivalent
• Knowledge of OWASP Top 10, vulnerability management and API security
• GitHub, GitHub Actions, GitGuardian, Snyk, CI/CD pipelines and security testing platforms
• Preferred: Azure Key Vault, HashiCorp Vault, GitHub Advanced Security, GitGuardian, Snyk, Azure, DevSecOps, and relevant certifications such as GIAC GSEC, GWEB, GWAPT, HashiCorp Vault Associate or GitHub Advanced Security