Security Engineer at Manulife

Job description

The Security Engineer plays a key role in strengthening Manulife's application security posture across its digital products, platforms, and financial services systems. Operating with greater autonomy, this role leads security assessments, drives remediation efforts, and actively contributes to the development of AppSec programs and standards. The ideal candidate brings solid hands-on experience in secure software development, offensive security techniques, AI-driven security automation, and cross-functional leadership — all grounded in Manulife's core values. Position Responsibilities: Lead end-to-end application security assessments including SAST, DAST, manual code reviews and penetration testing. Independently conduct ad hoc and scheduled penetration testing on web applications, APIs, AI/ML, and mobile applications — documenting and presenting findings to stakeholders. Perform in-depth analysis of OWASP Top 10 and advanced vulnerability classes including business logic flaws, broken access control, and insecure deserialization. Design, code, and deploy AI-powered automation tools and security scripts that enhance vulnerability detection, threat triage, and testing efficiency at scale. Write clean, maintainable code to build internal security tooling, integrations, and AI-assisted workflows that reduce manual effort across the Security Engineering Team. Conduct threat modeling for complex, high-risk systems and new product initiatives, recommending security architecture improvements. Serve as a security advisor and informal leader to development and product teams — driving security-by-design principles and secure coding best practices. Mentor and coach associate security engineers — conducting knowledge-sharing sessions, reviewing their work, and supporting their professional development. Produce clear, risk-rated vulnerability reports with actionable remediation guidance for both technical and non-technical audiences. Contribute to the development and maintenance of application security policies, standards, playbooks, and training materials. Stay ahead of evolving threats and vulnerabilities in the financial services and fintech space, translating intelligence into actionable controls. Required Qualifications: 3–6 years of hands-on experience in application security, with demonstrated ownership of security assessments and remediation cycles. Deep familiarity with OWASP Top 10, OWASP Testing Guide (OWTG), and OWASP Application Security Verification Standard (ASVS). Proven experience conducting Web application, API, AI/ML, Mobile and Desktop penetration testing using tools such as Burp Suite Pro, OWASP ZAP, or Metasploit. Demonstrated ability to code and build AI-powered security automation tools — including scripts or integrations using Python, JavaScript, or similar languages. Experience working with AI/ML APIs or LLM-based tools to automate security workflows such as vulnerability analysis, report generation, or threat detection. Demonstrated leadership skills — including the ability to guide peers, facilitate technical discussions, and influence security outcomes across teams. Excellent communication skills — able to articulate risk clearly to both technical teams and business stakeholders. Has background in threat modeling and mobile penetration testing. Preferred Qualifications: Industry certifications such as OSCP, GWAPT, eWPT, CSSLP, CISSP, or equivalent. Experience in banking, insurance, or financial services with working knowledge of PCI-DSS, BSP regulations, ISO 27001, or SOC 2. Cloud security experience on AWS, Azure, or GCP — including knowledge of cloud-native appsec controls. Experience with mobile application security testing on iOS and Android platforms. Proficiency in threat modeling using STRIDE, PASTA, or similar methodologies for complex, multi-tier systems. Exposure to red team exercises or bug bounty programs. Track record of leading or co-leading security initiatives, process improvements, or cross-tea