Security Engineer - Application Security

About the role

The Security Engineer strengthens Manulife's application security posture across its digital products, platforms and financial services systems. Working with greater autonomy, the role leads security assessments, drives remediation and helps build AppSec programs and standards. It calls for hands-on experience in secure software development, offensive security, AI-driven security automation and cross-functional leadership.

Key responsibilities

• Lead end-to-end application security assessments, including SAST, DAST, manual code reviews and penetration testing.
• Run ad hoc and scheduled penetration tests on web apps, APIs, AI/ML and mobile apps, documenting and presenting findings.
• Analyze OWASP Top 10 and advanced vulnerabilities such as business logic flaws, broken access control and insecure deserialization.
• Design, code and deploy AI-powered automation tools and security scripts for vulnerability detection and threat triage.
• Build internal security tooling, integrations and AI-assisted workflows.
• Conduct threat modeling for complex, high-risk systems and recommend security architecture improvements.
• Act as security advisor to development and product teams, promoting security-by-design and secure coding.
• Mentor associate security engineers through knowledge sharing, code review and coaching.
• Write risk-rated vulnerability reports with remediation guidance for technical and non-technical audiences.
• Help maintain application security policies, standards, playbooks and training materials.

Required profile

• 3-6 years of hands-on application security experience, owning security assessments and remediation cycles.
• Deep familiarity with OWASP Top 10, OWASP Testing Guide and OWASP ASVS.
• Experience with Web, API, AI/ML, Mobile and Desktop penetration testing using tools such as Burp Suite Pro, OWASP ZAP or Metasploit.
• Ability to code AI-powered security automation tools in Python, JavaScript or similar languages.
• Experience with AI/ML APIs or LLM-based tools to automate security workflows.
• Leadership skills and excellent communication with technical teams and business stakeholders.
• Background in threat modeling and mobile penetration testing.

Preferred qualifications

• Certifications such as OSCP, GWAPT, eWPT, CSSLP or CISSP.
• Banking, insurance or fintech experience with PCI-DSS, BSP, ISO 27001 or SOC 2.
• Cloud security on AWS, Azure or GCP, and mobile app security testing on iOS and Android.
• Threat modeling with STRIDE, PASTA or similar, red team or bug bounty exposure, and track record leading security initiatives.

Working arrangement is hybrid. Manulife is an Equal Opportunity Employer.