Senior Engineer, Application Security

At Cebu Pacific, we embrace challenges head-on,
staying at the forefront of innovation through agile technology, data-driven
insights, and a relentless focus on customer and operational excellence. A
career with our Digital Team offers you the opportunity to shape the
future of air travel—whether by developing cutting-edge digital products,
harnessing the power of analytics, or driving impactful projects that enhance
passenger experiences and streamline operations.

We don’t just build technology—we create experiences and
innovations that inspire and redefine the future of travel. Be part of this
exciting journey and let your expertise take flight as a moment maker in the
ever evolving field of Digital as a Senior Engineer, Application Security. Visit our careers site to learn more about how your moment
matters at Cebu Pacific: Cebu
Pacific Careers Site

A. WAF, Perimeter Security Engineering & ThreatAnalysis

• Administer,
  configure, and optimize WAF/WAAP and associated perimeter security
  controls protecting internet-facing applications and APIs.

• Manage
  security policies, custom rules, exceptions, and mitigation configurations
  to address emerging threats and application-specific requirements.

• Analyze
  HTTP/S traffic, WAF events, and application-layer attack patterns to
  investigate threats such as SQL injection, cross-site scripting, malicious
  scanning, automated abuse, and suspicious API activity.

• Validate
  suspected attacks and false positives, perform root-cause analysis, and
  implement evidence-based tuning and mitigation measures while maintaining
  legitimate application traffic.

• Configure
  and optimize edge security capabilities, including CDN delivery settings,
  origin protection, bot mitigation, IP reputation controls, and API
  security protections, where applicable.

• Manage
  and troubleshoot SSL/TLS certificates and configurations, including
  certificate provisioning, renewal, expiration monitoring, certificate
  chain validation, and secure TLS configuration across edge and origin
  connections.

• Support
  security onboarding, configuration changes, testing, and production
  deployments for new and existing applications.

• Evaluate
  security control effectiveness using threat trends, mitigation results,
  false-positive rates, and other relevant operational metrics to identify
  and implement continuous improvements.

B. Application Security Engineering

• Operate
  and enhance application security testing capabilities, including Static
  Application Security Testing (SAST), Dynamic Application Security Testing
  (DAST), and other supported security scanning technologies.

• Coordinate
  vulnerability assessments and penetration testing activities, including
  scope definition, findings validation, remediation tracking, and
  retesting.

• Assess
  application security findings and prioritize remediation based on risk,
  exploitability, and exposure, collaborating with development teams to
  address identified weaknesses.

• Establish
  and maintain application security standards, testing requirements,
  vulnerability remediation workflows, and security assessment
  procedures.

• Support
  secure software development practices and the integration of application
  security testing into development and release processes.

• Evaluate
  opportunities to strengthen application protection through application
  hardening, code obfuscation, and related security controls, where
  appropriate.

• Contribute
  to the standardization, consolidation, and continuous improvement of
  application security tools and processes.

C. Security Governance & Operational Sustainability

• Develop
  and maintain security configuration standards, technical documentation,
  operational procedures, and incident handling runbooks.

• Establish
  consistent processes for security policy changes, exception management,
  application onboarding, testing, approvals, and production
  implementation.

• Coordinate
  with SRE, infrastructure, application support, development teams, and
  external technology providers to maintain effective security
  operations.

• Support
  the transition of security services into sustainable operational ownership
  through knowledge transfer, documentation, defined responsibilities, and
  escalation procedures.

• Assess
  security control coverage, identify control gaps, and support audit and
  compliance requirements through appropriate technical evidence and
  documentation.

• Evaluate
  security technologies and operational processes to identify practical
  improvements aligned with security requirements, operational feasibility,
  and business priorities.

Qualifications

• Bachelor’s degree in Computer
  Science, Information Security, Engineering, or related field.

• Relevant certifications
  preferred (e.g., CISSP, CSSLP, CISM, CEH, GIAC, or equivalent)

• 5–10
  years of experience in cybersecurity, with strong focus on application
  security.

• Strong
  understanding of modern application architectures (APIs, microservices,
  cloud-native, containers).

• Experience
  in deploying vulnerability assessment tools and remediation
  programs.

• Experience
  in deploying and managing cloud platforms (AWS, Azure, or GCP) security
  controls and services preferred.

• Experience
  in cybersecurity, application security, WAF engineering, perimeter
  security, or security operations.

• Hands-on
  experience administering and optimizing enterprise WAF/WAAP or comparable
  application-layer security technologies. Preferably Akamai.

• Strong
  understanding of web application and API architectures, HTTP/S traffic,
  common web vulnerabilities, and attack mitigation techniques.

• Experience
  with application security testing tools, vulnerability management, and
  penetration testing activities.

• Ability
  to investigate complex security events, analyze technical evidence, and
  develop effective mitigation strategies.

• Experience
  working with application development, infrastructure, SRE, and operations
  teams to implement and sustain security controls.

• Strong
  analytical, problem-solving, technical documentation, and stakeholder
  communication skills.

• Experience
  with vendor management

Why Join Us

• We
  are the first Great Place to Work ® certified airline in Southeast
  Asia.

• We
  have been recognized as Best Employer Brand on LinkedIn for two
  consecutive years.

• Be
  part of a forward-thinking team that values innovation and continuous
  improvement.

• Play
  a key role in developing and nurturing the talents that drive our
  success.

• Accelerate
  your career with access to extensive learning programs and leadership
  development initiatives, all under Ceb U, our corporate university.

• Enjoy
  unique employee perks such as free travel for you and your family.
  Expanded coverage to common law partners and same sex partners!

• Be
  assured of a comprehensive healthcare coverage upon hire.

Note: This position is for an Individual Contributor and
will be based in Pasay City, Metro Manila but currently follows a hybrid
workplace flexibility arrangement.

Your moment matters. Be a Moment Maker!

Cebu Pacific warns the public against fake hiring and
training advertisements by unknown groups. We do not require payment from
candidates during the recruitment process nor do we require submission of
physical application documents. For official information on our job openings,
please visit our LinkedIn or career site at Cebu
Pacific Careers Site for reference.