Requirements

Must-haves

• 3+ years of software development experience
• Experience remediating security vulnerabilities in production environments
• Strong knowledge of the OWASP Top 10 and application security standards
• Direct coding and remediation experience with .NET (C#)
• Direct coding and remediation experience with TypeScript and JavaScript (Node.js, React, etc.)
• Deep understanding of web application security, common vulnerabilities, and secure coding practices
• Experience in analyzing and prioritizing vulnerabilities from SAST, DAST, SCA tools, and penetration tests
• Familiarity with Identity and Access Management (IAM) principles and best practices
• Ability to collaborate effectively with development teams and communicate technical risks clearly
• Strong communication skills in both spoken and written English

Nice-to-haves

• Startup experience
• Experience with microservices and API security design
• Familiarity with containerized environments and cloud security (AWS, GCP, Azure)
• Bachelor’s Degree in Computer Engineering, Computer Science, or equivalent

What you will work on

• Perform hands-on remediation of vulnerabilities across .NET, TypeScript, and JavaScript codebases
• Analyze and triage vulnerability reports from tools (SNYK, Codacy, penetration testing) to prioritize remediation efforts
• Conduct security code reviews (SAST) and dynamic testing (DAST) to identify and mitigate risks before release
• Provide in-code guidance to developers on secure coding practices and threat mitigation
• Ensure application-level security aligns with OWASP Top 10 and other relevant standards
• Assist in documenting secure coding standards and reusable remediation patterns
• Collaborate with development teams to integrate remediation work into the SDLC and sprint cycles
• Communicate security risks clearly to stakeholders and ensure timely, effective fixes
• Serve as a technical liaison for external penetration testing teams and support vulnerability validation and resolution
• Act as a hands-on, collaborative security partner to the engineering organization