Job Description & Details
This is a hands-on developer role focused entirely on tackling a massive backlog of security vulnerabilities on an internet-facing IAM platform. You won't just be writing new features from scratch; instead, you'll be diving deep into existing codebases to patch real-world security gaps. If you like untangling legacy code and ensuring applications are locked down against modern threats, this project will keep you very busy.
What You'll Actually Be Doing
Your day-to-day will revolve around reviewing security scanner findings, validating if they are true positives through manual and automated testing, and writing the code needed to fix them. You'll be working across a pretty diverse stack involving Java, .NET, Angular, and React, meaning you need to be comfortable context-switching between backend logic and frontend UI issues. A big part of your efficiency here will depend on your ability to group similar vulnerabilities together so you can fix multiple issues with a single, targeted code change rather than doing a million one-off patches.
The Core Tech Stack
Java is your main bread and butter here, alongside a solid grasp of secure coding practices and vulnerability management concepts. Because you're dealing with an IAM platform, understanding authentication flows and common attack vectors like OWASP Top 10 is non-negotiable. You'll also encounter .NET and modern JavaScript frameworks like Angular and React, so knowing how security flaws manifest in both backend services and frontend single-page apps will save you a lot of headache.
Interview Expectations
Expect the hiring team to hand you a realistic code snippet containing a common security flaw—like an injection vulnerability or broken access control—and ask you to spot it and fix it on the spot. They aren't looking for textbook definitions; they want to see your methodical approach to reading stack traces, interpreting vulnerability reports, and evaluating the blast radius of your proposed fix. They will also test your ability to explain complex security concepts clearly to non-security stakeholders.
Application Advice
Make sure your resume leans heavily into your practical security experience rather than just listing programming languages. Explicitly highlight any past work involving vulnerability remediation, static/dynamic code analysis (SAST/DAST), and secure coding in Java. Ensure acronyms like OWASP, IAM, and specific vulnerability classes are visible on your CV so you easily clear the initial ATS filters for security-focused engineering roles.