Job Description & Details
This is a heavy-duty security engineering gig focused on cleaning up an internet-facing IAM platform that's likely bleeding findings. If you hate digging through scan reports and actually writing code to fix the root cause, skip this one; otherwise, it's a solid 12-month contract for someone who speaks both security and enterprise development.
What You'll Actually Be Doing
Your day-to-day will revolve around ingesting high-severity vulnerability reports, figuring out if they're legit or false positives through hands-on validation, and then diving straight into the codebase to patch them. You won't just be throwing reports over the fence to development teams—you are expected to write the code fixes yourself, perform rigorous code reviews, debug the fallout, and run regression testing to ensure your patches don't break the identity provider.
The Core Tech Stack
Java is non-negotiable here because the core IAM platform runs on it, and you'll need deep expertise in secure coding principles to remediate complex auth flaws. While Java is your primary weapon, you also need working fluency in .NET/C# for backend overlaps and a solid grasp of Angular and React to understand frontend attack vectors. The team lives and breathes application security, so knowing how to interpret static and dynamic analysis findings down to the line of code is mandatory.
Interview Expectations
Expect the hiring manager to hand you a realistic code snippet containing an injection flaw or insecure deserialization in a Java context and ask you to walk through the remediation live. They are secretly testing whether you understand the architectural impact of your fix or if you're just slapping a band-aid on a systemic issue. Be ready to defend how you balance security constraints with delivery speed without sounding overly academic.
Application Advice
Make sure your resume doesn't just list security tools; highlight instances where you personally wrote code fixes for application vulnerabilities. Explicitly weave keywords like 'Java secure coding', 'IAM platform security', 'vulnerability validation', and '.NET/C#' into your project descriptions to get past the recruiter screen and directly onto the technical team's desk.