Senior Developer- Vulnerability Management

Job Title:
Senior Developer- Vulnerability Management

Location : 100% Remote Role USA

Duration : 12+ Months Contract

Teams Meeting Interview

Can technically validate findings and remediation evidence, distinguish symptoms from root cause, identify direct and transitive dependencies, verify whether a vulnerable component is loaded, reachable, or exploitable, recognize obsolete or shared assets, evaluate compensating controls, and determine whether remediation, false-positive closure, deferral, or risk acceptance is appropriate. Must also be able to build clear, accurate vulnerability reporting around findings, including severity, exploitability, affected assets and applications, ownership, remediation actions, target dates, aging, exceptions, closure evidence, trends, and business risk.

Must not close a finding based only on owner confirmation or a completed ticket.

evidence expectations, systems of record, ownership mappings, reporting templates, department and ADM groupings, distribution lists, risk-acceptance authorities, and reporting cadence.

Strong hands-on vulnerability remediation expertise is required. The candidate must be able to interpret a finding, identify the vulnerable component and attack path, determine the actual exposure and business impact, distinguish the root cause from the scan symptom, select the correct technical remediation, identify the implementation owner, define validation and rollback steps, and drive the issue through verified closure. Tracking alone is not sufficient.

• 1) Qualys
• 3) DAST - ZAP/ Invicti/ Burp Suite
• 4) Dev Secops - Scan pipelines at web applications level (Manoj to come back)
• 5) OWASP
  10

remediation timelines, dispatch-sheet structure, application portfolio, reporting cadence, and stakeholder map.

Deep experience interpreting Qualys server findings and determining the correct remediation at the operating-system, package, service, configuration, protocol, certificate, or network-control level. Must validate affected assets and installed versions, distinguish server findings from application issues, evaluate exploitability and compensating controls, recognize false positives, and specify patching, upgrades, configuration changes, service retirement, or isolation steps with validation and rollback requirements.

Qualys dispatch process, server ownership sources, application mapping, internal remediation teams, and risk-acceptance workflow.

Strong Wiz and GCP cloud-remediation skills are required. The candidate must interpret the affected resource, toxic combination or attack path, IAM and network exposure, data sensitivity, and runtime context; then determine the appropriate least-privilege IAM change, configuration correction, network restriction, encryption or logging control, resource replacement, or Terraform change. Must evaluate inheritance, organizational constraints, downstream impact, and validation before recommending implementation.

Wiz dashboards, GCP project ownership, CSPM contacts, due-date extension process, TFS routing, and organization-specific IAM decisions.

Strong remediation knowledge is required for both web applications and on-premises applications. The candidate must understand common web, API, client-server, middleware, database, and application-server weaknesses; identify the vulnerable code, library, framework, server, operating-system component, protocol, certificate, database configuration, or network dependency; assess exploitability and affected data flow; and provide actionable guidance such as input validation, output encoding, parameterized queries, authentication or authorization correction, dependency or framework upgrades, secret removal, secure header or TLS changes, application-server hardening, service-account correction, database remediation, patching, configuration changes, or retirement of obsolete components.

Must account for legacy-platform constraints, vendor dependencies, service impact, testing, rollback, rescanning, and closure evidence.

Invicti dispatch format, application ownership hierarchy, department reporting structure, and local escalation contacts.

Can translate scanner output into a technically complete…