Senior Application Security Engineer (AU, Retail, Hybrid)
ConnectOS is hiring a Senior Application Security Engineer to embed security into an Australian retail client's software delivery: building CI/CD security tooling and quality gates, running vulnerability management across app, container, and cloud layers, and hardening AWS infrastructure. It's a hands-on DevSecOps/AppSec role, hybrid in Manila with a 6am-3pm PHT schedule.
- Compensation
- Not disclosed
- Location
- Mandaluyong City, Metro Manila
- Work setup
- Hybrid
- Seniority
- Senior
- Employment
- Full time
- Experience
- 5+ years
- Category
- Security
- Posted
Skills
Must have
- 5+ years in security engineering or application security roles, or equivalent software/platform engineering experience with strong security focus
- Deep hands-on experience building, securing, and integrating security tooling into CI/CD pipelines
- Strong AWS knowledge across IAM, networking, compute, storage, and native security services
- Practical vulnerability management experience at scale (triage, prioritisation, remediation)
- Experience with appsec tooling: SAST, DAST, SCA, IaC scanning, container image scanning, secrets detection
- Understanding of OWASP Top 10, common web application vulnerabilities, and secure development principles
- Experience building custom tools, scripts, or automation rather than only configuring vendor products
- Experience applying AI/ML or LLMs to security or engineering workflows
- Strong communication skills with engineers and non-technical stakeholders
Nice to have
- Familiarity with container, API, and cloud-native security: Docker, Kubernetes/EKS, OAuth 2.0, OpenID Connect, API gateway security
- Experience building AI agents, RAG pipelines, or LLM-integrated tooling with awareness of AI/ML security risks
- Familiarity with threat modelling and compliance frameworks such as STRIDE, PASTA, ISO 27001, PCI DSS, SOC 2
Full description
**Schedule: Monday to Friday (6am to 3pm PHT)
Hybrid 2-3x per week onsite**
About the Role
The Senior Application Security Engineer is a hands-on, technically deep role that blends application security, DevSecOps, and cloud security engineering. The role embeds security directly into how software is built, deployed, and operated across client's technology estate. This role works horizontally across technologies such as CI/CD pipelines, cloud infrastructure, containers, APIs, and identity systems, and vertically through the stack from source code to runtime. The role is expected to build tools, automation, and scalable capabilities rather than only consuming vendor products.
The role sits within the Cyber Security team and works closely with Application Development, Cloud, and Data teams. It is designed to act as a practical, approachable security partner to engineering squads, helping teams reduce risk without becoming a gatekeeper or unnecessarily slowing delivery.
What will you do?
- Design, build, and maintain security controls embedded in CI/CD pipelines.
- Build quality gates that provide fast, actionable feedback to developers without blocking delivery unnecessarily.
- Own the security tooling pipeline, including selection, integration, tuning, false-positive reduction, and developer experience.
- Develop and maintain security-as-code artefacts, including policies, rulesets, and custom checks that scale across repositories and teams.
- Work with engineering teams to shift vulnerability detection left, catching issues at commit and build rather than in production.
- Define and maintain API security standards, particularly for externally facing and partner-integrated services.
- Own the technical execution of vulnerability management across application, container, and cloud layers.
- Triage, prioritise, and drive remediation of vulnerabilities from sources such as Wiz, AWS Inspector, Defender, SAST, and DAST tools.
- Correlate vulnerability findings with asset context, including internet exposure, data sensitivity, identity permissions, and business criticality.
- Build and improve vulnerability reporting, metrics, and observability.
- Identify systemic root causes such as stale AMIs, unpatched base images, and outdated dependencies, and drive permanent fixes over one-off patches.
- Review and harden Infrastructure-as-Code, including Terraform and CloudFormation, for security misconfigurations before deployment.
- Contribute to AWS account baselining, onboarding, and security architecture patterns.
- Support penetration testing coordination, including scoping, remediation tracking, and retest validation.
- Provide practical security guidance to delivery teams during design, development, deployment, and operational support.