Application Security Engineer (Threat Modeling)

About the role

Manulife is looking for an experienced Application Security Engineer specializing in Threat Modeling to join its Global Cybersecurity Services (GCS) Team in Quezon City. This individual-contributor role acts as a trusted security partner to engineering, architecture, product and risk teams, identifying design risks early and turning them into practical security requirements. The position is hybrid, with three onsite days per week, and may require a fixed late mid-shift or night-shift schedule.

Key responsibilities

• Lead threat modeling engagements for applications, APIs, cloud services, third-party integrations and major technology changes from early design through implementation.
• Work with engineering and architecture teams to define scope and document system components, assets, data flows, entry points, trust boundaries, dependencies and assumptions.
• Apply threat modeling approaches such as STRIDE, attack trees, abuse cases, PASTA or LINDDUN, and assess threats by likelihood, impact, exploitability, asset criticality and existing controls.
• Translate threats into security requirements, design recommendations, test criteria and remediation actions, tracking them to closure or formal risk acceptance.
• Provide governance and quality oversight, embed threat modeling into architecture reviews, agile delivery, change management, security testing and penetration testing, and coach delivery teams.
• Maintain standards, templates, threat libraries and secure design patterns, and produce metrics and reporting on delivery performance and risk reduction.

Required profile

• Bachelor's degree in Computer Science, Software Engineering, Information Technology, Cybersecurity or a related field, or equivalent practical experience.
• At least five years of relevant experience in threat modeling, application security, security architecture, secure software development, cloud security or a related discipline.
• Demonstrated experience leading collaborative threat modeling or secure design reviews.
• Amenable to the hybrid arrangement and to a fixed late mid-shift or night-shift schedule.

Required skills

• Practical knowledge of at least one threat modeling method (STRIDE, attack trees, abuse cases, PASTA, LINDDUN).
• Working knowledge of application and API security, IAM, data protection, cloud and network architecture, containers, distributed systems and common attack techniques.
• Familiarity with OWASP, MITRE ATT&CK and the NIST Secure Software Development Framework.
• Preferred: experience in regulated industries, cloud platforms (Azure, AWS, GCP), Kubernetes, microservices, reusable threat libraries, threat modeling tools (Threat Modeling Tool, Threat Dragon, IriusRisk, pytm, Visio), and security certifications such as CISSP or CSSLP.