{"id":2378986,"url":"https://alion.io/job/pmconsulting-application-security-engineerlead-devsecopscicd-security","title":"Application Security Engineer/Lead (DevSecOps/CI/CD Security)","company":{"id":4421389,"name":"PM Consulting","domain":"pmconsulting.ph","url":"https://alion.io/company/pmconsulting-2","size_band":"1001-5000","is_staffing_agency":true,"employer_type":"agency","is_intermediary":false,"listed_via":null,"ats_vendor":"Manatal","truth_index":null},"role":"Security","role_family":"Security","seniority":"lead","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Quezon City, Philippines"],"countries":["PH"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":23000,"max_usd":59000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":588},"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"C#","optional":false},{"name":"CI/CD","optional":false},{"name":"GCP","optional":false},{"name":"Go","optional":false},{"name":"JavaScript","optional":false},{"name":"Least Privilege","optional":false},{"name":"OWASP Top 10","optional":false},{"name":"Python","optional":false},{"name":"Threat Modeling","optional":false},{"name":"TypeScript","optional":false}],"status":"live","first_seen_at":"2026-10-12T18:59:17Z","employer_posted_date":"2026-10-12","last_verified_at":"2026-10-13T16:33:52Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"We are partnering with a leading technology-driven organization to hire an experienced Application Security Engineer / Lead. This role focuses on embedding security throughout the software development lifecycle (SDLC) and reducing application risk across cloud-native and containerized environments.\nYou will collaborate closely with engineering, DevOps, and product teams to implement scalable DevSecOps practices, integrate automated security controls into CI/CD pipelines, and promote secure-by-design principles, ensuring a strong security posture without impacting delivery speed.\n\nKey Responsibilities\nIntegrate security practices across all phases of the SDLC, from planning to deployment, in collaboration with cross-functional teams\nDesign, implement, and manage application security testing programs, including Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), Software Composition Analysis (SCA), Interactive Application Security Testing (IAST), Runtime Application Self-Protection (RASP)\nEmbed automated security checks and quality gates within CI/CD pipelines to ensure consistent and scalable controls\nPerform API security assessments, including validation of authentication, authorization, input handling, and abuse scenarios\nConduct or coordinate penetration testing for web applications and APIs, and validate remediation efforts\nLead threat modeling sessions and secure design reviews for modern architectures (e.g., microservices, serverless, containerized applications)\nEstablish and manage vulnerability triage and remediation processes, including prioritization and tracking to resolution\nDefine and promote secure coding standards; provide hands-on support through code reviews and guidance\nSupport application-layer security across cloud environments, including identity management, secrets handling, and network exposure\nImplement best practices for secrets management, configuration security, and least-privilege access\nDevelop dashboards and reporting metrics to track security coverage, remediation timelines, and overall risk trends\nEvaluate and onboard application security tools, optimizing for performance and developer usability\nDeliver training sessions and knowledge-sharing initiatives to improve developer security awareness\nParticipate in incident response related to application vulnerabilities, including root cause analysis and preventive improvements\n\nCore Technical Requirements\nStrong hands-on experience with:\nSAST (tooling, tuning, and remediation support)\nDAST (scan configuration, authenticated testing, and validation)\nSCA (open-source risk management and dependency analysis)\nFamiliarity with IAST and/or runtime security testing approaches\nUnderstanding of RASP or runtime protection mechanisms in production environments\nProven experience in API security testing, including common risks and mitigation techniques\nSolid background in penetration testing for web applications and APIs\nDeep understanding of common application vulnerabilities (e.g., OWASP Top 10) and secure coding practices\n\nDevSecOps & Tooling\nExperience working in DevOps environments with CI/CD pipelines and automated deployments\nProven ability to integrate security controls into development workflows without disrupting delivery\nHands-on experience with CI/CD platforms (e.g., pipeline configuration, build/release processes, artifact management)\nFamiliarity with Infrastructure-as-Code (IaC), pipeline templating, and policy-as-code practices\n\nCloud & Engineering Background\nExperience with at least one major cloud platform (e.g., Azure, AWS, or GCP), including security fundamentals\nSoftware development background with the ability to review and understand code (e.g., C#, Java, JavaScript/TypeScript, Python, Go)\nFamiliarity with modern application architectures such as microservices, containers, and serverless environments\nProfessional Skills\nAbility to communicate technical risks effectively to both technical and non-technical stakeholders\nStrong collaboration and stakeholder management skills\nCapability to influence teams and drive security adoption in a fast-paced environment\nExperience defining standards, processes, and measurable security outcomes (e.g., KPIs, SLAs)\n\nNice-to-Have Skills\nExperience with common application security tools across SAST, DAST, and SCA categories\nFamiliarity with web application firewalls (WAF), API gateways, or service mesh security\nRelevant security or cloud certifications","description_format":"text","description_chars":4486,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Application Security","DevSecOps"],"lifecycle":[{"event":"open","at":"2026-10-12T18:59:17Z"}],"visa":[],"liveness":{"score":52,"band":"ok","label":"Likely open","p_open":1,"p_active":0.516,"p_room":1,"age_days":0,"expected_fill_days":29,"reasons":["conf:0","agency","win:early","comp:brand"],"computed_at":"2026-10-13T05:45:00Z"},"pay":null,"html_url":"https://alion.io/job/pmconsulting-application-security-engineerlead-devsecopscicd-security","json_url":"https://alion.io/job/pmconsulting-application-security-engineerlead-devsecopscicd-security.json","meta":{"generated_at":"2026-10-13T17:39:43Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":26930,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-14T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":4421389},"rest":"https://alion.io/mcp/rest/get_company?id=4421389"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fpmconsulting-application-security-engineerlead-devsecopscicd-security"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fpmconsulting-application-security-engineerlead-devsecopscicd-security"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fpmconsulting-application-security-engineerlead-devsecopscicd-security"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/pmconsulting-application-security-engineerlead-devsecopscicd-security\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fpmconsulting-application-security-engineerlead-devsecopscicd-security"}]}