Senior Cybersecurity Engineer

This is a fully remote position, open to applicants in Philippines.

📋 Description

• Conduct manual testing of both public-facing and internal web applications and APIs, covering authenticated journeys, authentication, session management, object and role authorization, tenant boundaries, and business logic vulnerabilities.

• Utilize scanners to complement, not replace, manual testing efforts.

• Evaluate mobile applications, focusing on local storage, logging, authentication and session management, network trust, platform interactions, and backend APIs.

• Collaborate with developers to review source code, configurations, and designs.

• Integrate threat modeling, security checks, and regression testing into the development lifecycle, including scanning for code, dependencies, and secrets in CI/CD.

• Document reproducible findings and their business impacts, confirm remediation responsibilities and deadlines, assist in root-cause analysis, and independently retest fixes.

• Monitor security coverage, overdue risks, and time-sensitive risk exceptions alongside the Head of Technology.

• Define written testing scope and authorization, which includes environments, test accounts and data, production safeguards, and stop conditions.

• Safeguard customer information and minimize disruptions during the testing process.

• Manage security posture within Microsoft Entra ID and Microsoft Defender, addressing Conditional Access, MFA coverage, privileged access, and alert routing.

• Oversee incident response from detection through to post-incident evaluation.

• Review security-critical application, access, network, and infrastructure modifications prior to release.

• Serve as the designated security approver for high-risk changes; facilitate separate reviews for personal high-risk changes and escalate any unresolved release risks.

• Enforce best practices for secrets and identity management using Azure Key Vault, managed identities, and applying least privilege principles without embedded credentials.

• Investigate account takeover and fraud indicators in collaboration with QA and Customer Service teams.

• Conduct security awareness and phishing resistance training programs for Voltex staff.

⛳️ Requirements

• Demonstrated hands-on expertise in application security testing and successfully driving fixes through retesting.

• Experience in web and API security, specifically in investigating and validating vulnerabilities in authenticated websites, web applications, and APIs, including authorization and business logic flaws.

• Proficient in using an intercepting proxy like Burp Suite or a similar tool.

• Practical experience assessing mobile client security and backend APIs.

• Capability to read and interpret source code and configurations, articulate root causes, collaborate with developers on solutions, and validate retests and regression coverage.

• Familiarity with .NET/IIS or relevant transferable experience.

• Experience in securing Microsoft Azure workloads and hybrid environments, including on-premises servers and Active Directory.

• Proficiency in Entra ID administration, Conditional Access design, MFA implementation, and privileged access management.

• Knowledge of Microsoft Defender and EDR platforms; experience with CrowdStrike is a plus.

• Experience with Intune device management.

• Familiarity with firewalls, segmentation, and SASE/SD-WAN environments; experience with Cato is desirable.

• Incident response experience encompassing detection, containment, and post-incident documentation.

• Familiarity with OWASP guidelines and the ASD Essential Eight or a similar framework.

• Ability to convey risk in straightforward business terminology.

• Capability to work remotely across AU/NZ time zones and function independently as the sole security specialist.

• Preferred: AZ-500, SC-200, or equivalent qualifications.

• Preferred: Experience securing Databricks or managing access to AI tools and agents.

• Preferred: Experience with phishing simulation and security awareness training programs.

• Preferred: Advanced skills in native mobile testing, reverse engineering, or commissioning and validating specialized penetration tests.

🏝️ Benefits

• Fully remote work with flexible hours.

• Paid parental leave.

• Annual and sick leave.

• 20 Service Incentive Leave (SIL) days each year.

• Healthcare - HMO coverage for up to four (4) dependents.

• Monthly food allowance.