Provide governance and quality oversight at key stages of the threat modeling process, confirming that scope, assets, threats, mitigations, and supporting evidence are complete and aligned with security standards.
Embed threat modeling into architecture reviews, agile delivery, change management, security testing, penetration testing, and other Secure SDLC activities.
Maintain and improve standards, templates, threat libraries, secure design patterns, and reusable mitigation guidance; identify opportunities for automation and self-service adoption.
Coach delivery teams, review the quality and coverage of threat models, identify recurring design risks, and communicate outcomes, exceptions, and trends to technical and business stakeholders.
Produce accurate service metrics and reporting that demonstrate delivery performance, adoption, quality, mitigation follow-through, and measurable risk reduction.
Required Qualifications
Bachelor’s degree in Computer Science, Software Engineering, Information Technology, Cybersecurity, or a related field, or equivalent practical experience.
At least five years of relevant experience across threat modeling, application security, security architecture, secure software development, cloud security, or a related discipline.
Demonstrated experience leading collaborative threat modeling or secure design reviews for applications, APIs, cloud-native systems, distributed architectures, or third-party integrations.
Ability to analyze architectures and data flows, identify trust boundaries and attack paths, prioritize material threats, and translate findings into testable requirements and practical mitigations.
Practical knowledge of at least one established threat modeling method, such as STRIDE, attack trees, abuse cases, PASTA, or LINDDUN, with the ability to select and adapt methods for different engagements.
Working knowledge of application and API security, identity and access management, data protection, cloud and network architecture, containers, distributed systems, and common attack techniques.
Familiarity with relevant standards and frameworks, including OWASP guidance, MITRE ATT&CK, and the NIST Secure Software Development Framework.
Experience incorporating threat modeling into architecture governance, Secure SDLC activities, security testing, penetration testing, remediation, and risk acceptance processes.
Strong analytical, facilitation, technical-writing, and stakeholder-management skills, with the ability to work independently and communicate risk clearly to technical and business audiences.
Amenable to work at UP Ayala Technohub, Quezon City, under a hybrid arrangement with three onsite days per week.
Amenable to work a fixed late mid-shift or night-shift schedule based on business requirements.
Preferred Qualifications
Experience supporting an enterprise threat modeling, application security, product security, or security architecture program, preferably in financial services, insurance, or another regulated industry.
Experience assessing modern architectures, including Microsoft Azure, AWS, Google Cloud, Kubernetes, microservices, event-driven systems, APIs, mobile applications, or AI-enabled solutions.
Experience creating reusable threat libraries, reference threat models, secure design patterns, architecture decision records, or mitigation guidance.
Experience with threat modeling or diagramming tools such as Microsoft Threat Modeling Tool, OWASP Threat Dragon, IriusRisk, pytm, Visio, or comparable solutions.
Knowledge of privacy threat modeling, software supply-chain risks, AI and agentic-system risks, cloud shared-responsibility models, or emerging attack techniques.
Experience improving adoption through developer enablement, self-service approaches, automation, quality criteria, metrics, or maturity assessments.
A relevant security or architecture certification, such as ISC2 CSSLP or CISSP, Microsoft Azure Security Engineer Associate, GIAC Defensible Security Architecture, SABSA, TOGAF, or an equivalent credential.
What Success Looks Like
Threat modeling engagements are completed on time, with clear scope, strong technical coverage, and decisions that stakeholders can act on.
Material design risks are identified early and translated into practical requirements that are tracked to closure or documented risk acceptance.
Threat models remain current as architectures change, and mitigation evidence is complete, traceable, and aligned with governance expectations.
Delivery teams increasingly apply repeatable threat modeling practices through effective coaching, reusable guidance, and self-service resources.
Recurring design risks and service trends are converted into measurable improvements to standards, tooling, automation, and the Secure SDLC.
When you join our team
We’ll empower you to learn and grow the career you want.
We’ll recognize and support you in a flexible environment where well-being and inclusion are more than just words.
As part of our global team, we’ll support you in shaping the future you want to see.
Manulife is an Equal Opportunity Employer
At Manulife/John Hancock, we embrace our diversity. We strive to attract, develop and retain a workforce that is as diverse as the customers we serve and to foster an inclusive work environment that embraces the strength of cultures and individuals. We are committed to fair recruitment, retention, advancement and compensation, and we administer all of our practices and programs without discrimination on the basis of race, ancestry, place of origin, colour, ethnic origin, citizenship, religion or religious beliefs, creed, sex (including pregnancy and pregnancy-related conditions), sexual orientation, genetic characteristics, veteran status, gender identity, gender expression, age, marital status, family status, disability, or any other ground protected by applicable law.
It is our priority to remove barriers to provide equal access to employment. A Human Resources representative will work with applicants who request a reasonable accommodation during the application process. All information shared during the accommodation request process will be stored and used in a manner that is consistent with applicable laws and Manulife/John Hancock policies. To request a reasonable accommodation in the application process, contact recruitment@manulife.com.
About Manulife and John Hancock
Manulife Financial Corporation is a leading international financial services provider, helping people make their decisions easier and lives better. To learn more about us, visit https://www.manulife.com/en/about/our-story.html.
Manulife is an Equal Opportunity Employer
At Manulife/John Hancock, we embrace our diversity. We strive to attract, develop and retain a workforce that is as diverse as the customers we serve and to foster an inclusive work environment that embraces the strength of cultures and individuals. We are committed to fair recruitment, retention, advancement and compensation, and we administer all of our practices and programs without discrimination on the basis of race, ancestry, place of origin, colour, ethnic origin, citizenship, religion or religious beliefs, creed, sex (including pregnancy and pregnancy-related conditions), sexual orientation, genetic characteristics, veteran status, gender identity, gender expression, age, marital status, family status, disability, or any other ground protected by applicable law.
It is our priority to remove barriers to provide equal access to employment. A Human Resources representative will work with applicants who request a reasonable accommodation during the application process. All information shared during the accommodation request process will be stored and used in a manner that is consistent with applicable laws and Manulife/John Hancock policies. To request a reasonable accommodation in the application process, contact hr@manulife.com.
Working Arrangement
Hybrid
