Mid / Senior IT Security Engineer

About the role

Based on your experience and readiness for ownership, you may be considered for a mid or senior IT security engineering pathway. You will work with software engineering, DevOps, and operations to design practical controls, review risky changes, and respond to security issues in products built for Filipino users and businesses. This is a XieTech employment engagement, not a client project placement.

What you'll do

• Review designs, pull requests, and infrastructure changes for security risks and recommend workable fixes
• Help teams apply secure coding, authentication, secrets handling, logging, and least-privilege practices
• Configure and improve cloud, identity, endpoint, and application security controls that fit an early-stage stack
• Triage vulnerabilities and security findings, then track remediation through ownership, evidence, and closure
• Support incident response from detection through containment, communication, and lessons learned
• Document threat assumptions, control decisions, and runbooks so security work does not depend on one person
• On the senior track, set security engineering standards, mentor contributors, and guide risk tradeoffs with leadership

What you'll bring

• For the mid pathway: approximately 3 years of professional experience in security engineering, application security, cloud security, or a closely related security role
• For the senior track: deeper production ownership, including security architecture, mentoring, and sustained delivery of security improvements
• Practical experience securing web applications, APIs, cloud environments, or identity systems
• Working knowledge of common vulnerabilities, secure design, access control, logging, and incident handling
• Ability to explain risk and remediation clearly to engineers who are not security specialists
• Careful handling of credentials, personal data, logs, and other sensitive information
• Clear written communication and follow-through in a remote, flexible-time team

Nice to have

• Experience with SIEM, vulnerability scanning, endpoint protection, or infrastructure-as-code review
• Familiarity with OWASP guidance, cloud security baselines, or secure SDLC practices
• Relevant security certification or a record of shipped security improvements
• Familiarity with Philippine data privacy obligations and how they affect product and platform design