Our Client, a Banking company, is looking for a Full stack Java Developer (React/Node, OWASP Top 10/Vulnerabilities/SAST) for their Plano, TX/Charlotte, NC /Hybrid location.
Responsibilities:
Own remediation of findings from SAST, SCA/FOSS, DAST, secrets, and API scans, including Checkmarx.
Analyze CVE, CWE, and CVSS findings to determine exploitability, business impact, and remediation priority.
Perform root-cause and dependency-chain analysis when vulnerabilities originate from third-party frameworks or packages.
Fix frontend vulnerabilities in React.js, NPM, MVN, JavaScript, TypeScript, HTML, and CSS, including XSS and insecure client-side patterns.
Fix backend vulnerabilities in Java/Spring Boot and/or Node.js, including injection, auth/authz flaws, insecure deserialization, SSRF, path traversal, and misconfiguration.
Upgrade outdated frameworks and libraries, implementing required code changes to fully resolve CVEs rather than relying only on version bumps.
Replace vulnerable or unsupported libraries with secure alternatives when upgrades are insufficient, including API migration and refactoring.
Decouple tightly coupled JARs/modules and resolve dependency conflicts across Maven, Gradle, npm, and yarn ecosystems.
Generate and maintain SBOMs and map components to CVE exposure.
Validate remediation through build, unit, integration, regression testing, and security rescanning.
Document remediation evidence, affected components, technical changes, validation results, and closure status.
Partner with Application Security and infrastructure/platform teams when remediation crosses application boundaries.
Use SonarQube findings to identify and remediate code-quality and security hotspots, ensuring issues are resolved with code-level fixes before release.
Own framework/runtime compatibility decisions by validating which Java and Apache dependency versions are supported by the target Spring Boot version before remediation and upgrades.
Maintain and enforce a version compatibility matrix for Java, Spring Boot, Apache libraries, and build plugins across services.
Monitor NIST NVD and related vendor advisories for newly published CVEs affecting Java/Spring Boot, React/Node, SQL components, and transitive dependencies.
Requirements:
Primary Skill
Core Java
Secondary Skill
Spring boot
Tertiary Skill
ReactJS
Required Qualifications
8+ years of software development experience.
5+ years of hands-on Java development experience.
3+ years of hands-on Spring Boot and REST API development.
3+ years of full-stack experience with React and Node.js.
Proven production experience remediating OWASP Top 10/CWE vulnerabilities.
Checkmarx experience required; equivalent enterprise SAST/SCA tooling accepted only with proven hands-on remediation ownership.
Strong dependency-management expertise across npm/yarn, package.json, lock files, Maven, and Gradle.
Proven experience replacing legacy/vulnerable libraries with approved alternatives, including dependency mapping, API migration, compatibility testing, and rollback planning.
Experience maintaining 100% SBOM coverage for in-scope production releases.
Experience configuring Maven, Gradle, npm, and yarn to resolve dependencies exclusively through the Bank-approved JFrog repository.
Hands-on experience with SonarQube (or SonarCloud), including vulnerability triage, quality-gate management, and remediation verification.
Proven experience with Java and Spring Boot version alignment, including Java 11+ environments, and Apache library compatibility management.
Strong expertise in Maven/Gradle BOMs, dependency convergence, and resolving version conflicts during CVE remediation.
Strong Git and Bitbucket experience, including branching strategy, pull requests, code reviews, and merge controls.
Hands-on CI/CD pipeline experience, including Bitbucket Pipelines and/or enterprise CI/CD tooling.
Integrate SAST, SCA, secret scanning, SBOM generation, and policy gates into CI/CD.
Enforce release gates that block unresolved, policy-violating Critical/High issues unless formally risk-approved.
Automate rescans and remediation verification in pull request and post-merge workflows.
Enforce controls to block builds when dependencies are pulled from non-approved external repositories.
Enforce controls to prevent reintroduction of banned/vulnerable libraries and ensure approved replacement libraries are used.
Apply secure pipeline practices, including least-privilege credentials, protected branches, signed artifacts, and controlled release approvals.
Integrate SonarQube quality gates into CI/CD and enforce build/merge failures when security or quality thresholds are not met.
Desired Qualifications
SQL / Databases: SQL knowledge plus database security concepts, connections, credentials, encryption, and access controls.
GitHub Copilot experience for secure coding productivity and faster remediation.
Experience with GitHub Advanced Security, CodeQL, and Dependabot.
Container and IaC security remediation experience.
Why Should You Apply?
Health Benefits
Referral Program
Excellent growth and advancement opportunities