{"id":1167533,"url":"https://alion.io/job/manulife-application-security-engineer-penetration-testing-quality-assurance","title":"Application Security Engineer - Penetration Testing Quality Assurance","company":{"id":6650,"name":"Manulife","domain":"manulife.com","url":"https://alion.io/company/manulife","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"A","score":99,"open_postings":111,"ghost_share":0,"stale_share":0.225,"repost_share":0.054,"time_to_fill_p50_days":18,"computed_at":"2026-10-15T05:46:00Z"}},"role":"Security","role_family":"Security","seniority":"middle","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Manila, Philippines"],"countries":["PH"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":15500,"max_usd":37000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":714},"experience_years_min":3,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Burp Suite","optional":false},{"name":"CVSS","optional":false},{"name":"CWE","optional":false},{"name":"OWASP","optional":false},{"name":"Snyk","optional":false},{"name":"PowerShell","optional":true},{"name":"Python","optional":true},{"name":"Unix","optional":true}],"status":"live","first_seen_at":"2026-09-24T04:21:28Z","employer_posted_date":"2026-09-24","last_verified_at":"2026-10-15T03:47:59Z","board_verified":true,"closed_at":null,"days_open":21,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":21},"description":"We are looking for an experienced Application Security Engineer to serve as the quality-assurance point for penetration testing deliverables across applications and APIs. In this individual-contributor role, you will independently review reports and findings before release, confirm that risk ratings and supporting evidence are sound, and help application teams move findings through remediation and closure. You will work closely with penetration testers, vulnerability management leads, and technology stakeholders to maintain consistent reporting standards, improve testing quality, and provide clear, risk-based guidance.\nKey Responsibilities:\nPerform final quality reviews of penetration test reports before release, ensuring findings are technically accurate, reproducible, supported by sufficient evidence, within the approved scope, and written for both technical and business audiences.\nValidate affected assets, exploitation paths, business impact, duplicate findings, and false positives; challenge conclusions when the evidence does not support the stated risk.\nReview and calibrate severity ratings using CVSS, exploitability, asset criticality, business impact, environmental context, and existing compensating controls.\nConfirm that test scope, methodology, coverage, assumptions, limitations, and conclusions are complete and clearly documented; work with testers to address gaps before reports are issued.\nProvide practical, risk-based remediation guidance and help application teams understand the issue, expected corrective action, and evidence required for closure.\nTrack open findings and agreed remediation dates, coordinate retesting, validate corrective actions, and document closure decisions or residual risks.\nTriage newly disclosed or emerging vulnerabilities to determine relevance, potential exposure, required validation, and appropriate escalation.\nSupport day-to-day Burp Suite and Snyk operations, including access requests, scan configuration, issue triage, troubleshooting, scheduling, reporting, and coordination with platform owners.\nMaintain quality standards, review checklists, reporting templates, and operating procedures; identify recurring defects and recommend improvements to testing, reporting, and aftercare processes.\nProduce accurate status updates and quality metrics, and escalate material risks, overdue actions, or delivery concerns to the appropriate stakeholders.\nRequired Qualifications:\nBachelor’s degree in Computer Science, Computer Engineering, Information Technology, Cybersecurity, or a related field, or equivalent practical experience.\nAt least three years of relevant experience in penetration testing, application security, vulnerability assessment, vulnerability management, or security quality assurance.\nHands-on experience reviewing penetration test reports, validating technical evidence, assessing exploitability and business impact, assigning or challenging severity ratings, and confirming remediation through retesting.\nStrong knowledge of web application and API security, common attack techniques, authentication and authorization weaknesses, OWASP testing practices, CVSS, CWE, and vulnerability classification.\nPractical experience with Burp Suite Professional or comparable web and API security testing tools.\nWorking knowledge of SAST, DAST, SCA, open-source vulnerability management, DevSecOps pipelines, and the end-to-end vulnerability management lifecycle.\nStrong analytical judgment and attention to detail, with the ability to distinguish material risk from low-value noise and make defensible, evidence-based decisions.\nClear written and verbal communication skills, including the ability to explain technical risk and remediation expectations to technical and non-technical stakeholders.\nAbility to manage competing priorities, follow through on commitments, and work effectively with globally distributed teams.\nAmenable to a hybrid work arrangement at UP Ayala Technohub, Quezon City, with three onsite days per week.\nAmenable to a fixed late mid-shift or night-shift schedule based on business requirements.\nPreferred Qualifications:\nExperience performing or reviewing penetration tests for web applications, APIs, mobile applications, cloud environments, or networks, including assessments delivered by third-party providers.\nExperience in enterprise application security or vulnerability management within financial services, insurance, or another regulated industry.\nFamiliarity with OWASP WSTG, PTES, NIST SP 800-115, or comparable penetration testing and reporting standards.\nExperience using vulnerability management or issue-tracking platforms to manage evidence, ownership, remediation dates, exceptions, retesting, and closure.\nExperience with Snyk administration or enterprise application security tooling, including onboarding, scan configuration, troubleshooting, reporting, and stakeholder support.\nAbility to automate data processing, quality checks, workflow updates, dashboards, or reports using Python, PowerShell, Unix shell, VBA, or a similar scripting language.\nA relevant certification such as OSCP, OSWE, CREST CCT/CRT, GIAC GWAPT/GPEN, CompTIA PenTest+, or an equivalent credential.\nWhat Success Looks Like:\nPenetration test reports are complete, technically defensible, consistent, and ready for stakeholders on time.\nFindings are accurately prioritized, clearly explained, and supported by evidence that enables timely remediation.\nRetesting and closure decisions are traceable, risk-based, and aligned with established standards.\nRecurring quality issues are identified and converted into practical improvements to testing, reporting, and aftercare processes.\nundefined\nWhen you join our team:\nWe’ll empower you to learn and grow the career you want. We’ll recognize and support you in a flexible environment where well-being and inclusion are more than just words. As part of our global team, we’ll support you in shaping the future you want to see.\nManulife is an Equal Opportunity Employer At Manulife/John Hancock, we embrace our diversity. We strive to attract, develop and retain a workforce that is as diverse as the customers we serve and to foster an inclusive work environment that embraces the strength of cultures and individuals. We are committed to fair recruitment, retention, advancement and compensation, and we administer all of our practices and programs without discrimination on the basis of race, ancestry, place of origin, colour, ethnic origin, citizenship, religion or religious beliefs, creed, sex (including pregnancy and pregnancy-related conditions), sexual orientation, genetic characteristics, veteran status, gender identity, gender expression, age, marital status, family status, disability, or any other ground protected by applicable law. It is our priority to remove barriers to provide equal access to employment. A Human Resources representative will work with applicants who request a reasonable accommodation during the application process. All information shared during the accommodation request process will be stored and used in a manner that is consistent with applicable laws and Manulife/John Hancock policies. To request a reasonable accommodation in the application process, contact .\nAbout Manulife and John Hancock\nManulife Financial Corporation is a leading international financial services provider, helping people make their decisions easier and lives better. To learn more about us, visit https://www.manulife.com/en/about/our-story.html.\nManulife is an Equal Opportunity Employer\nAt Manulife/John Hancock, we embrace our diversity. We strive to attract, develop and retain a workforce that is as diverse as the customers we serve and to foster an inclusive work environment that embraces the strength of cultures and individuals. We are committed to fair recruitment, retention, advancement and compensation, and we administer all of our practices and programs without discrimination on the basis of race, ancestry, place of origin, colour, ethnic origin, citizenship, religion or religious beliefs, creed, sex (including pregnancy and pregnancy-related conditions), sexual orientation, genetic characteristics, veteran status, gender identity, gender expression, age, marital status, family status, disability, or any other ground protected by applicable law.\nIt is our priority to remove barriers to provide equal access to employment. A Human Resources representative will work with applicants who request a reasonable accommodation during the application process. All information shared during the accommodation request process will be stored and used in a manner that is consistent with applicable laws and Manulife/John Hancock policies. To request a reasonable accommodation in the application process, contact .\nWorking Arrangement\nHybrid","description_format":"text","description_chars":8861,"description_truncated":false,"requirements":{"experience_years_min":3,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":["Hybrid work"],"hiring_locations":[{"name":"Philippines","iso":"PH","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Penetration Testing","Information Security","Application Security","Vulnerability Management"],"lifecycle":[{"event":"open","at":"2026-09-24T04:21:28Z"}],"visa":[],"liveness":{"score":39,"band":"fade","label":"Fading","p_open":1,"p_active":0.713,"p_room":0.55,"age_days":21,"expected_fill_days":18,"reasons":["conf:1","velocity","win:tail","comp:brand"],"computed_at":"2026-10-15T05:46:00Z"},"pay":null,"html_url":"https://alion.io/job/manulife-application-security-engineer-penetration-testing-quality-assurance","json_url":"https://alion.io/job/manulife-application-security-engineer-penetration-testing-quality-assurance.json","meta":{"generated_at":"2026-10-15T06:12:52Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":9390,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-16T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":6650},"rest":"https://alion.io/mcp/rest/get_company?id=6650"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fmanulife-application-security-engineer-penetration-testing-quality-assurance"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fmanulife-application-security-engineer-penetration-testing-quality-assurance"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fmanulife-application-security-engineer-penetration-testing-quality-assurance"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/manulife-application-security-engineer-penetration-testing-quality-assurance\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fmanulife-application-security-engineer-penetration-testing-quality-assurance"}]}