Job Description & Details
This is a hands-on remediation gig focused purely on clearing out a massive backlog of security vulnerabilities on a critical internet-facing Identity and Access Management (IAM) platform. Instead of building new features from scratch, you will spend your time dissecting security scan findings, verifying if they are false positives or actual threats, and pushing out the necessary code fixes. If you enjoy untangling legacy codebases and hardening enterprise applications against real-world attack vectors, this is a solid project to sink your teeth into.
What You'll Actually Be Doing
Your day-to-day will revolve around reviewing static and dynamic security findings, validating them through targeted testing, and writing precise code patches to close the gaps. You won't just be tossing tickets over the fence; you'll need to strategically group related vulnerabilities together to minimize unnecessary code churn and deployment friction. Because this touches an internet-facing IAM system, your work directly protects user identity data, meaning code quality and attention to detail are non-negotiable.
The Core Tech Stack
Java is your primary weapon here, complemented by .NET, Angular, and React depending on which layer of the stack the security finding lands on. You need a strong foundation in backend Java development paired with a security-first mindset. Knowing how typical enterprise web apps fail—OWASP Top 10 vulnerabilities, injection flaws, broken auth, and insecure dependencies—is critical because you'll be knee-deep in remediation across multiple frameworks simultaneously.
Interview Expectations
Expect the interviewers to drop a real-world security finding on your lap and ask you to walk them through how you would verify and patch it. They are secretly testing whether you can distinguish a theoretical CVE from an exploitable vulnerability in their specific codebase without breaking existing business logic. They will also probe your ability to communicate complex security risks to non-security stakeholders, looking for clarity and pragmatism over academic jargon.
Application Advice
Make sure your resume doesn't just read like a standard feature-developer CV; explicitly highlight your experience with vulnerability management, security patching, and secure coding practices. Weave keywords like OWASP Top 10, Java security, static code analysis, and vulnerability remediation naturally into your work history to easily clear the ATS filters. Emphasize any past experience where you owned the security backlog or collaborated directly with AppSec teams.