Senior Engineer Application Security

Department

Digital & Technology Office

Employee Type

Regular

At Cebu Pacific , we embrace challenges head-on, staying at the forefront of innovation through agile technology, data-driven insights, and a relentless focus on customer and operational excellence. A career with our Digital Team offers you the opportunity to shape the future of air travel—whether by developing cutting-edge digital products, harnessing the power of analytics, or driving impactful projects that enhance passenger experiences and streamline operations.

We don’t just build technology—we create experiences and innovations that inspire and redefine the future of travel. Be part of this exciting journey and let your expertise take flight as a moment maker in the ever evolving field of Digital as a Senior Engineer, Application Security . Visit our careers site to learn more about how your moment matters at Cebu Pacific: Cebu Pacific Careers Site

Primary Responsibilities:

• WAF, Perimeter Security Engineering & Threat Analysis
• Administer, configure, and optimize WAF/WAAP and associated perimeter security controls protecting internet-facing applications and APIs.
• Manage security policies, custom rules, exceptions, and mitigation configurations to address emerging threats and application-specific requirements.
• Analyze HTTP/S traffic, WAF events, and application-layer attack patterns to investigate threats such as SQL injection, cross-site scripting, malicious scanning, automated abuse, and suspicious API activity.
• Validate suspected attacks and false positives, perform root-cause analysis, and implement evidence-based tuning and mitigation measures while maintaining legitimate application traffic.
• Configure and optimize edge security capabilities, including CDN delivery settings, origin protection, bot mitigation, IP reputation controls, and API security protections, where applicable.
• Manage and troubleshoot SSL/TLS certificates and configurations, including certificate provisioning, renewal, expiration monitoring, certificate chain validation, and secure TLS configuration across edge and origin connections.
• Support security onboarding, configuration changes, testing, and production deployments for new and existing applications.
• Evaluate security control effectiveness using threat trends, mitigation results, false-positive rates, and other relevant operational metrics to identify and implement continuous improvements.
• Application Security Engineering
• Operate and enhance application security testing capabilities, including Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and other supported security scanning technologies.
• Coordinate vulnerability assessments and penetration testing activities, including scope definition, findings validation, remediation tracking, and retesting.
• Assess application security findings and prioritize remediation based on risk, exploitability, and exposure, collaborating with development teams to address identified weaknesses.
• Establish and maintain application security standards, testing requirements, vulnerability remediation workflows, and security assessment procedures.
• Support secure software development practices and the integration of application security testing into development and release processes.
• Evaluate opportunities to strengthen application protection through application hardening, code obfuscation, and related security controls, where appropriate.
• Contribute to the standardization, consolidation, and continuous improvement of application security tools and processes.
• Security Governance & Operational Sustainability
• Develop and maintain security configuration standards, technical documentation, operational procedures, and incident handling runbooks.
• Establish consistent processes for security policy changes, exception management, application onboarding, testing, approvals, and production implementation.
• Coordinate with SRE, infrastructure, application support, development teams, and external technology providers to maintain effective security operations.
• Support the transition of security services into sustainable operational ownership through knowledge transfer, documentation, defined responsibilities, and escalation procedures.
• Assess security control coverage, identify control gaps, and support audit and compliance requirements through appropriate technical evidence and documentation.
• Evaluate security technologies and operational processes to identify practical improvements aligned with security requirements, operational feasibility, and business priorities.
  
  

• Bachelor’s degree in Computer Science, Information Security, Engineering, or related field.
• Relevant certifications preferred (e.g., CISSP, CSSLP, CISM, CEH, GIAC, or equivalent)
• 5–10 years of experience in cybersecurity, with strong focus on application security.
• Strong understanding of modern application architectures (APIs, microservices, cloud-native, containers).
• Experience in deploying vulnerability assessment tools and remediation programs.
• Experience in deploying and managing cloud platforms (AWS, Azure, or GCP) security controls and services preferred.
• Experience in cybersecurity, application security, WAF engineering, perimeter security, or security operations.
• Hands-on experience administering and optimizing enterprise WAF/WAAP or comparable application-layer security technologies. Preferably Akamai.
• Strong understanding of web application and API architectures, HTTP/S traffic, common web vulnerabilities, and attack mitigation techniques.
• Experience with application security testing tools, vulnerability management, and penetration testing activities.
• Ability to investigate complex security events, analyze technical evidence, and develop effective mitigation strategies.
• Experience working with application development, infrastructure, SRE, and operations teams to implement and sustain security controls.
• Strong analytical, problem-solving, technical documentation, and stakeholder communication skills.
• Experience with vendor management
  
  

• We are the first Great Place to Work ® certified airline in Southeast Asia.
• We have been recognized as Best Employer Brand on LinkedIn for two consecutive years.
• Be part of a forward-thinking team that values innovation and continuous improvement.
• Play a key role in developing and nurturing the talents that drive our success.
• Accelerate your career with access to extensive learning programs and leadership development initiatives, all under Ceb U, our corporate university.
• Enjoy unique employee perks such as free travel for you and your family. Expanded coverage to common law partners and same sex partners!
• Be assured of a comprehensive healthcare coverage upon hire.