Senior Developer

Key Responsibilities
Technically validate vulnerability findings and remediation evidence, distinguish symptoms from root causes, and identify direct and transitive dependencies
Determine whether vulnerable components are loaded, reachable, or exploitable, recognize obsolete or shared assets, evaluate compensating controls, and recommend remediation, false-positive closure, deferral, or risk acceptance as appropriate
Develop accurate vulnerability reports covering severity, exploitability, affected assets and applications, ownership, remediation actions, target dates, aging, exceptions, closure evidence, trends, and business risk
Ensure findings are not closed solely on owner confirmation or ticket completion; verify remediation evidence and technical effectiveness
Analyze vulnerability findings using Qualys and application security tools such as SonarQube, JFrog, Wiz, ZAP, Invicti, and Burp Suite
Apply knowledge of DevSecOps scanning pipelines and OWASP Top 10 risks to support vulnerability identification and remediation
Interpret Qualys server findings and determine appropriate remediation at the operating system, package, service, configuration, protocol, certificate, or network-control level
Validate affected server assets and installed versions, assess exploitability and compensating controls, identify false positives, and recommend patching, upgrades, configuration changes, service retirement, or isolation
Analyze Wiz findings in Google Cloud Platform environments by evaluating affected resources, attack paths, toxic combinations, IAM and network exposure, data sensitivity, and runtime context
Recommend appropriate cloud remediation, including least-privilege IAM changes, configuration corrections, network restrictions, encryption and logging controls, resource replacement, or Terraform changes
Assess inheritance, organizational constraints, downstream impact, and validation requirements before recommending cloud changes
Remediate or provide technical guidance for web, API, client-server, middleware, database, and application-server vulnerabilities
Identify vulnerable code, libraries, frameworks, server components, operating system packages, protocols, certificates, database configurations, and network dependencies
Recommend actionable fixes, including input validation, output encoding, parameterized queries, authentication and authorization corrections, dependency upgrades, secret removal, secure header and TLS changes, server hardening, service-account corrections, database remediation, patching, configuration changes, or retirement of obsolete components
Account for legacy-platform constraints, vendor dependencies, service impact, testing, rollback, rescanning, and closure evidence when planning remediation
Translate scanner findings into technically complete remediation plans for application, infrastructure, cloud, vendor, CSPM, and DevSecOps teams
Define required changes, implementation owners, dependencies, service and security impacts, testing procedures, rollback steps, target dates, closure evidence, and escalation paths
Challenge vague remediation updates and obtain actionable implementation plans from responsible teams
Design, build, and maintain vulnerability reports and dashboards that present findings by severity, exploitability, application or asset, owner, remediation action, target date, age, overdue status, exception status, closure evidence, trends, and business impact
Reconcile source data and identify incorrect metrics, duplicate findings, missing or inconsistent data, ownership gaps, and reporting discrepancies before distributing reports
Support Terraform-related cloud remediation by understanding infrastructure changes, identifying when engineering support is required, and routing actionable work to the DevSecOps Run Team
Validate automated report outputs against source data, identify logic or mapping defects, and provide precise correction requirements
Coordinate with application, infrastructure, cloud, vendor, CSPM, and DevSecOps teams to track remediation progress and resolve outstanding issues
Document recurring processes, dashboards, follow-up procedures, active issues, and operational handover requirements to maintain continuity

Required Qualifications
8+ years of experience
Bachelors Degree

Skills
Qualys
Wiz
SonarQube
JFrog
ZAP
Invicti
Burp Suite
Google Cloud Platform Cloud Security
Terraform
Python
Power Automate
OWASP Top 10
Server Vulnerability Remediation
Database and Middleware Security
Vulnerability Management
Remediation Coordination
Vulnerability Reporting and Dashboards
Cloud Risk Remediation
DevSecOps Pipeline Integration
Application Security Testing
Root Cause and Attack Path Analysis
Cross-team Dependency Management
Technical Documentation
Knowledge Transfer

Schedule
Start date: 2026-11-30