Application Security Enablement Engineer

About the role

The Asia CISO function ensures cybersecurity risk management, regulatory compliance and secure technology enablement across Asia markets. This Application Security Enablement Engineer role sits within the regional cybersecurity leadership team and drives application security across the software development lifecycle, bridging global strategy and regional execution with engineering, architecture and development teams. The position is based in Makati City and is hybrid.

Key responsibilities

• Drive adoption of enterprise application security standards across applications, platforms and cloud environments.
• Enable automation for vulnerability detection, remediation, exception review and reporting.
• Provide risk-based technical guidance and training to developers on secure design and coding (e.g. OWASP).
• Work with architects, product owners and developers to embed secure-by-design principles.
• Conduct and validate application security testing (automated and manual), including intake and validation of findings from external penetration tests and bug bounty programs.
• Support vulnerability management: triage, exception review, remediation and reporting.
• Conduct application and architecture-level threat modeling for new applications, major enhancements and high-risk changes, and help build templates, playbooks and threat libraries.
• Help scale workstreams such as secrets, SCA, SAST and DAST remediation, and integrate security into CI/CD pipelines and DevSecOps workflows.
• Validate and contextualize findings from automated tools, penetration tests and external assessments.
• Partner with Global Application Security, the CIO, engineering and architecture teams, and align with the Vulnerability Management function on remediation prioritization and risk treatment.

Required profile

• Minimum 5+ years in application security or software development roles focused on secure coding and DevSecOps.
• Strong understanding of application security principles, SDLC and CI/CD pipelines, and of application penetration testing.
• Knowledge of secure coding standards and frameworks such as OWASP Top 10 and NIST.
• Excellent collaboration and communication skills with developers and stakeholders.
• Preferred: hands-on experience with security tools (Secrets, SCA, SAST, container security, DAST) and automation frameworks, familiarity with cloud-native security, and certifications such as OSCP, CISSP or equivalent.

Required skills

• SAST, DAST and SCA tools
• OWASP Top 10, NIST
• CI/CD pipelines and DevSecOps
• Preferred: WAF, NAC, API security, Kubernetes, IaC, hybrid cloud and penetration testing toolchains