Job Description & Details
This role is a classic remediation grind where you are brought in specifically to tackle a mountain of security debt on a critical IAM platform. If you enjoy diving deep into codebases to patch vulnerabilities rather than building brand-new features from scratch, this is a straightforward contract that lets you put your security and development skills to immediate use.
What You'll Actually Be Doing
You will spend your days wading through a backlog of security findings, figuring out which ones are legitimate threats versus false positives, and writing the code to fix them. You'll be touching multiple parts of the tech stack, verifying bugs through rigorous testing, and figuring out how to batch your code changes so you fix five vulnerabilities with a single, elegant patch instead of rewriting half the application.
The Core Tech Stack
Your bread and butter here will be Java, but you also need to be comfortable poking around .NET, Angular, and React because the IAM platform spans across these technologies. The real make-or-break skill is a deep-seated understanding of vulnerability management, meaning you actually know how common web and application security flaws manifest in code and how to remediate them securely without breaking production.
Interview Expectations
Expect the interviewer to test your ability to interpret raw security scan reports, often by asking you to explain how you would validate whether a reported remote code execution or injection finding is a true positive. They are secretly looking for someone who doesn't just blindly follow a scanner, but actually understands the underlying mechanics of the vulnerability. You'll also likely be grilled on how you approach refactoring legacy code in Java or .NET to fix security flaws while minimizing regressions.
Application Advice
Make sure your resume leans heavily into both your development background and your security chops, specifically highlighting any past work you've done with vulnerability remediation, static analysis tools, and OWASP Top 10 fixes. Ensure keywords like Vulnerability Management, Java, code review, and IAM are explicitly stated in your experience section to get past the automated filters and catch the hiring manager's eye.