About the role

What you’ll do

• Remediate application vulnerabilities across Java/Spring Boot, React, and Node.js systems
• Manage secure dependencies and replace legacy/vulnerable libraries with approved alternatives
• Validate fixes through testing and security rescans
• Support security controls and quality gates in CI/CD pipelines
• Maintain 100% SBOM coverage for in-scope production releases
• Configure Maven, Gradle, npm, and yarn to resolve dependencies through the approved JFrog repository

What you’ll need

• 8+ years of software development experience, with 5+ years in Java and 3+ years in Spring Boot/REST API and React/Node.js
• Proven production experience remediating OWASP Top 10/CWE vulnerabilities
• Checkmarx experience required; equivalent enterprise SAST/SCA tooling accepted with proven hands-on remediation ownership
• Strong dependency-management expertise across npm/yarn, Maven, and Gradle, including replacing vulnerable libraries, maintaining 100% SBOM coverage, and configuring JFrog repository resolution
• Hands-on SonarQube/SonarCloud experience with vulnerability triage, quality-gate management, and remediation verification
• Experience with CI/CD pipelines, Bitbucket/Git, GitHub Advanced Security/CodeQL/Dependabot, and container/IaC security remediation

Original job description