Application Security Enablement Engineer

The Asia CISO function is responsible for ensuring effective cybersecurity risk management, regulatory compliance, and secure technology enablement across all Asia markets. This role sits within the regional cybersecurity leadership team and is accountable for application security enablement across the software development lifecycle. It serves as the bridge between global application security strategy and regional execution, driving outcomes through strong partnership and influence across application development, engineering, and architecture teams in both regional and market environments. Deliver application security engineering and enablement capabilities across Asia, embedding secure development practices into the software development lifecycle (SDLC) and enabling adoption of enterprise security standards. This role focuses on driving vulnerability assessment, prioritization and remediation, centralized exception review, threat modeling, and SME support to strengthen application security posture. Position Responsibilities: Help drive adoption of enterprise application security standards across applications, platforms, and cloud environments Enable automation for vulnerability detection, remediation, exception review and reporting to improve efficiency and consistency. Provide actionable, risk-based technical guidance and training to developers on secure design and coding standards (e.g., OWASP). Partner with architects, product owners, and development teams during design and planning phases to embed secure-by-design principles. Conduct and validate application security testing (automated and manual), including intake and validation of findings from external penetration tests and bug bounty programs. Accountabilities: Individual Accountabilities: Support vulnerability management processes, including triage, exception review, remediation, and reporting. Conduct application and architecture-level Threat Modeling for new applications, major enhancements, and high-risk changes. Support uplift of Threat Modeling maturity by defining templates, playbooks, and reusable threat libraries for common platforms and patterns. Support to scale workstreams such as secrets, SCA, SAST, DAST vulnerability remediation. Partner with development teams to integrate security expectations into CI/CD pipelines and DevSecOps workflows. Validate and contextualize findings from automated tools, penetration tests, and external assessments where design-level issues are identified. Key Shared Accountabilities: Partner with Global Application Security on standards, tooling and continuous improvement Collaborate with CIO, engineering, and architecture teams to ensure consistent adoption and accountability Align with Vulnerability Management function on remediation prioritization and risk treatment Support audit, regulatory, and control assurance activities Required Qualifications: Minimum 5+ years in application security or software development roles with a focus on secure coding and DevSecOps. Strong understanding of application security principles, SDLC, and CI/CD pipelines. Strong understanding of application penetration testing Knowledge of secure coding standards and frameworks (e.g., OWASP Top 10, NIST). Excellent collaboration and communication skills to engage developers and stakeholders. Preferred Qualifications: Hands-on experience with security tools (e.g., Secrets, SCA, SAST, Container security, DAST) and automation frameworks. Familiarity with cloud-native application security concepts. Certifications: OSCP, CISSP or preferred equivalent. Additional certifications such as Advanced application testing certifications (OSWP, GIAC GWAPT, INE eWPTX) are considered an advantage. Tooling and Technology Coverage: In addition to SAST, DAST, and SCA, familiarity with complementary controls such as WAF and NAC were relevant to application-layer protection. Practical exposure to API security, Kubernetes and container platforms, Infrastructure as Code (IaC), hybrid cloud environments, and penetration testing or vulnerability scanning toolchains. When you join our team: We’ll empower you to learn and grow the career you want. We’ll recognize and support you in a flexible environment where well-being and inclusion are more than just words. As part of our global team, we’ll support you in shaping the future you want to see. About Manulife and John Hancock Manulife Financial Corporation is a leading international financial services provider, helping people make their decisions easier and lives better. To learn more about us, visit https://www.manulife.com/en/about/our-story.html. Manulife is an Equal Opportunity Employer At Manulife/John Hancock, we embrace our diversity. We strive to attract, develop and retain a workforce that is as diverse as the customers we serve and to foster an inclusive work environment that embraces the strength of cultures and individuals. We are committed to fair recruitment, retention, advancement and compensation, and we administer all of our practices and programs without discrimination on the basis of race, ancestry, place of origin, colour, ethnic origin, citizenship, religion or religious beliefs, creed, sex (including pregnancy and pregnancy-related conditions), sexual orientation, genetic characteristics, veteran status, gender identity, gender expression, age, marital status, family status, disability, or any other ground protected by applicable law. It is our priority to remove barriers to provide equal access to employment. A Human Resources representative will work with applicants who request a reasonable accommodation during the application process. All information shared during the accommodation request process will be stored and used in a manner that is consistent with applicable laws and Manulife/John Hancock policies. To request a reasonable accommodation in the application process, contact hr@manulife.com. Working Arrangement Hybrid We're Manulife. And we’re on a mission to make decisions easier and lives better. Better is what drives us. It’s what inspires us to find new ways to support customers and colleagues in living longer and healthier lives. It’s the reason we’re dedicated to investing in digital innovation and industry-leading AI, and accelerating a sustainable and economically inclusive future. Joining us means you’ll be empowered to learn and grow your career. We’ll recognize and support you in a flexible environment where well-being and inclusion are more than just words. And as part of our global team, you’ll help shape the future you want to see – and discover that better can take you anywhere you want to go. We’re proud of our accomplishments and recognition. Recent awards include: 2026 Gallup Exceptional Workplace Award Winner Manulife Named one of Forbes World’s Best Employers 2025 Financial Times World’s Best Employers Asia-Pacific 2026 We’ve been recognized as one of Canada’s Top 100 Employers 2026 #1 Life Insurer for AI Maturity by Evident 2026 To receive our latest job opportunities directly to your inbox, create an account or sign in and navigate to the ‘Job Alerts’ section located in the top right corner of the page. From there, you can sign up to receive job alerts. Our ambition is to be the number one choice for customers. Learn more at https://www.manulife.com/.