Application Security Engineer

We are looking for an Application Security Engineer (Secure Development and Secrets Management) to join the Global Cybersecurity Services (GCS) – Application Security Rapid Lab Team. In this role, you will partner with Application Security teams, developers, and business stakeholders to advance enterprise secrets remediation and secure software development initiatives. The candidate should have working knowledge of designing and implementing secure solutions that eliminate hard-coded secrets, strengthen application security controls, and integrate applications with approved enterprise platforms such as Azure Key Vault and HashiCorp Vault. The candidate may support these activities based on business and project needs. The ideal candidate combines strong software engineering fundamentals with hands-on application security experience and can clearly communicate remediation strategies, architecture decisions, and technical contributions. Have the skills and experience for the job? Learn more about it below! Position Responsibilities: Application Security and Secrets Remediation: Assess applications for hard-coded secrets, credentials, certificates, API keys, and configuration risks; support the definition and implementation of secure migration approaches using Azure Key Vault, HashiCorp Vault, or equivalent approved platforms. Secure Software Development: Design, develop, and maintain secure backend services, APIs, reusable components, libraries, and utilities using Java, Python, C#, or equivalent technologies, applying secure-by-design and Secure SDLC principles. Automation and Integration: Contribute to the development of scalable automation and automated remediation capabilities, integrate security controls into CI/CD pipelines, and help reduce manual remediation effort across multiple applications. Security Assessment and Remediation: Analyze and prioritize findings from SAST, DAST, SCA, secrets scanning, penetration testing, code reviews, and other assessments; support risk-based remediation with minimal business impact. Architecture and Preventive Controls: Participate in solution and architecture reviews, recommend secure patterns, and address root causes to reduce recurring security risks. Stakeholder Engagement: Participate in discovery, requirements gathering, solution design, and technical reviews. Communicate security risks, trade-offs, remediation plans, and implementation guidance to technical and non-technical stakeholders across global teams. Required Qualifications: Bachelor’s degree in Computer Science, Software Engineering, Computer Engineering, Information Technology, Cybersecurity, or a related technical discipline. Minimum of five years of software engineering experience, including secure application development and vulnerability remediation using Java, Python, C#, or equivalent technologies. Proven experience developing backend applications, APIs, reusable components, automation utilities, and security-focused tools or frameworks. Hands-on experience applying Secure SDLC principles and secure coding practices across design, development, testing, deployment, and maintenance. Experience triaging and remediating findings from SAST, DAST, SCA, secrets scanning, penetration testing, code reviews, and vulnerability assessments. Working knowledge of secrets management, credential lifecycle management, and application integration using Azure Key Vault, HashiCorp Vault, or equivalent enterprise platforms. Knowledge of securely managing API keys, tokens, certificates, database credentials, and other application secrets, including remediation and rotation practices. Strong understanding of application security, OWASP Top 10, vulnerability management, API security, backend architecture, object-oriented programming, design patterns, and reusable component design. Hands-on experience with GitHub, GitHub Actions, GitGuardian, Snyk, CI/CD pipelines, modern development environments, and security testing or vulnerability management platforms. Demonstrated ability to explain technical designs, architecture decisions, security trade-offs, remediation approaches, and individual project contributions. Ability to work independently, manage complex technical challenges, and collaborate effectively with developers, architects, executives, and business stakeholders. Excellent verbal and written communication, problem-solving, customer focus, and stakeholder management skills. Amenable to work at UP Ayala Technohub, Quezon City under a hybrid setup (three days a week). Amenable to work on a fixed late mid-shift or night-shift schedule based on business requirements. Preferred Qualifications: Experience supporting enterprise Application Security, Secrets Management, DevSecOps, or Platform Security programs. Experience in financial services, insurance, or another regulated industry, including work with globally distributed and multicultural teams. Knowledge of Microsoft Azure, cloud-native security controls, workload identity, identity integration, certificate management, secrets rotation, and CI/CD security controls. Relevant certifications such as ISC2 CSSLP, CompTIA Security+, GIAC GSEC, GIAC GWEB, GIAC GWAPT, HashiCorp Certified: Vault Associate, GitHub Advanced Security, GitHub Actions, or an equivalent industry credential. Relevant training in secure coding, Secure SDLC, OWASP Top 10, threat modeling, application security architecture, vulnerability remediation, and defensive web application security. Product or platform training in Azure Key Vault, HashiCorp Vault, GitHub Advanced Security, GitHub Actions, GitGuardian, Snyk, secrets detection and remediation, and CI/CD security. Exposure to or hands-on experience with AI-assisted software development, security automation, or the responsible use of generative AI to support secure coding, vulnerability analysis, remediation, testing, and developer workflows. Experience contributing to process improvement initiatives, including identifying automation opportunities, simplifying workflows, addressing root causes, defining measurable outcomes, and improving the efficiency and scalability of Application Security services. When you join our team: We’ll empower you to learn and grow the career you want. We’ll recognize and support you in a flexible environment where well-being and inclusion are more than just words. As part of our global team, we’ll support you in shaping the future you want to see. About Manulife and John Hancock Manulife Financial Corporation is a leading international financial services provider, helping people make their decisions easier and lives better. To learn more about us, visit https://www.manulife.com/en/about/our-story.html . Manulife is an Equal Opportunity Employer At Manulife/John Hancock, we embrace our diversity. We strive to attract, develop and retain a workforce that is as diverse as the customers we serve and to foster an inclusive work environment that embraces the strength of cultures and individuals. We are committed to fair recruitment, retention, advancement and compensation, and we administer all of our practices and programs without discrimination on the basis of race, ancestry, place of origin, colour, ethnic origin, citizenship, religion or religious beliefs, creed, sex (including pregnancy and pregnancy-related conditions), sexual orientation, genetic characteristics, veteran status, gender identity, gender expression, age, marital status, family status, disability, or any other ground protected by applicable law. It is our priority to remove barriers to provide equal access to employment. A Human Resources representative will work with applicants who request a reasonable accommodation during the application process. All information shared during the accommodation request process will be stored and used in a manner that is consistent with applicable laws and Manulife/John Hancock policies. To request a reasonable accommodation in the application process, contact hr@manulife.com . Working Arrangement Hybrid