Senior Security Engineer (AU Retail, Hybrid)

About The Role

The Senior Security Engineer (Application Security) is a hands-on, technically deep role that blends application security, DevSecOps, and cloud security engineering. The role embeds security directly into how software is built, deployed, and operated across Flybuys' technology estate. This role works horizontally across technologies such as CI/CD pipelines, cloud infrastructure, containers, APIs, and identity systems, and vertically through the stack from source code to runtime. The role is expected to build tools, automation, and scalable capabilities rather than only consuming vendor products.

The role sits within the Cyber Security team and works closely with Application Development, Cloud, and Data teams. It is designed to act as a practical, approachable security partner to engineering squads, helping teams reduce risk without becoming a gatekeeper or unnecessarily slowing delivery.

Key Areas of Accountability

• Design, build, and maintain security controls embedded in CI/CD pipelines.
• Build quality gates that provide fast, actionable feedback to developers without blocking delivery unnecessarily.
• Own the security tooling pipeline, including selection, integration, tuning, false-positive reduction, and developer experience.
• Develop and maintain security-as-code artefacts, including policies, rulesets, and custom checks that scale across repositories and teams.
• Work with engineering teams to shift vulnerability detection left, catching issues at commit and build rather than in production.
• Define and maintain API security standards, particularly for externally facing and partner-integrated services.
• Own the technical execution of vulnerability management across application, container, and cloud layers.
• Triage, prioritise, and drive remediation of vulnerabilities from sources such as Wiz, AWS Inspector, Defender, SAST, and DAST tools.
• Correlate vulnerability findings with asset context, including internet exposure, data sensitivity, identity permissions, and business criticality.
• Build and improve vulnerability reporting, metrics, and observability.
• Identify systemic root causes such as stale AMIs, unpatched base images, and outdated dependencies, and drive permanent fixes over one-off patches.
• Review and harden Infrastructure-as-Code, including Terraform and CloudFormation, for security misconfigurations before deployment.
• Contribute to AWS account baselining, onboarding, and security architecture patterns.
• Support penetration testing coordination, including scoping, remediation tracking, and retest validation.
• Provide practical security guidance to delivery teams during design, development, deployment, and operational support.

• 5+ years in security engineering, DevSecOps, or application security roles, or equivalent software/platform engineering experience with a strong security focus.
• Deep hands-on experience building, securing, and integrating security tooling into CI/CD pipelines.
• Strong AWS knowledge across IAM, networking, compute, storage, and native security services.
• Practical experience with vulnerability management at scale, including triage, prioritisation, and remediation across diverse technology environments.
• Experience with application security tooling such as SAST, DAST, SCA, IaC scanning, container image scanning, and secrets detection.
• Understanding of OWASP Top 10, common web application vulnerabilities, and secure development principles.
• Demonstrated experience building custom tools, scripts, or automation rather than only configuring vendor products.
• Practical experience applying AI/ML or LLMs to security or engineering workflows, such as automated triage, code analysis, data enrichment, or agent-based automation.
• Strong communication skills, with the ability to explain technical risk to both engineers and non-technical stakeholders.

• Familiarity with container, API, and cloud-native security, including Docker, Kubernetes/EKS, OAuth 2.0, OpenID Connect, and API gateway security.
• Experience building AI agents, RAG pipelines, or LLM-integrated tooling, with awareness of AI/ML security risks and mitigations.
• Familiarity with threat modelling and compliance frameworks such as STRIDE, PASTA, ISO 27001, PCI DSS, or SOC 2.

• Hybrid Work Arrangement
• Medical, Dental Coverage and Life insurance from day 1 of employment
• Paid Vacation and Sick Leave (with Quarterly Sick Leave Conversion)
• Competitive salary package and annual appraisal
• Financial Assistance Program
• Mandatory Government Benefits and 13th Month Pay
• Complimentary Sleeping Quarters, Coffee at no cost
• Complimentary Office Fitness and Wellness Facilities at no cost
• Regular Company Events, Work Life Balance, and Career growth opportunities
• Accessible location at the heart of Metro Manila --- the Mega Tower, EDSA

ConnectOS is certified as a Great Place to Work and is a top-rated Philippines employer of choice.

#ConnectOSCareers #JoinConnectOS #ConnectOSTech

Equal Employment Statement Employment decisions at ConnectOS will be conducted without consideration of factors such as age', race, color, religion, gender, disability status, sexual orientation, gender identity or expression, genetic information, and marital status. ConnectOS ensures the full confidentiality of the data it processes.