Senior Developer

Select how often (in days) to receive an alert:
Create Alert

NTT DATA strives to hire exceptional, innovative and passionate individuals who want to grow with us. If you want to be part of an inclusive, adaptable, and forward-thinking organization,

We are currently seeking a Senior Developer to join our team in Plano, Texas (US-TX), United States (US).

JD for - GD Offshore - Senior Developer:

Skill Area:
Must-Have 1:
Technical judgment, false-positive review, and findings reporting:
Can technically validate findings and remediation evidence, distinguish symptoms from root cause, identify direct and transitive dependencies, verify whether a vulnerable component is loaded, reachable, or exploitable, recognize obsolete or shared assets, evaluate compensating controls, and determine whether remediation, false-positive closure, deferral, or risk acceptance is appropriate. Must also be able to build clear, accurate vulnerability reporting around findings, including severity, exploitability, affected assets and applications, ownership, remediation actions, target dates, aging, exceptions, closure evidence, trends, and business risk.

Must not close a finding based only on owner confirmation or a completed ticket.

Teachable / Learn During Onboarding:
evidence expectations, systems of record, ownership mappings, reporting templates, department and ADM groupings, distribution lists, risk-acceptance authorities, and reporting cadence.

Must-Have 2:
Vulnerability management operations:
Strong hands-on vulnerability remediation expertise is required. The candidate must be able to interpret a finding, identify the vulnerable component and attack path, determine the actual exposure and business impact, distinguish the root cause from the scan symptom, select the correct technical remediation, identify the implementation owner, define validation and rollback steps, and drive the issue through verified closure. Tracking alone is not sufficient.

Teachable:
remediation timelines, dispatch-sheet structure, application portfolio, reporting cadence, and stakeholder map.

Must-Have 3:
Qualys server vulnerability analysis:
Deep experience interpreting Qualys server findings and determining the correct remediation at the operating-system, package, service, configuration, protocol, certificate, or network-control level. Must validate affected assets and installed versions, distinguish server findings from application issues, evaluate exploitability and compensating controls, recognize false positives, and specify patching, upgrades, configuration changes, service retirement, or isolation steps with validation and rollback requirements.

Teachable:
Qualys dispatch process, server ownership sources, application mapping, internal remediation teams, and risk-acceptance workflow.

Must-Have 4:
Wiz and GCP cloud-risk analysis:
Strong Wiz and GCP cloud-remediation skills are required. The candidate must interpret the affected resource, toxic combination or attack path, IAM and network exposure, data sensitivity, and runtime context; then determine the appropriate least-privilege IAM change, configuration correction, network restriction, encryption or logging control, resource replacement, or Terraform change. Must evaluate inheritance, organizational constraints, downstream impact, and validation before recommending implementation.

Teachable:
Wiz dashboards, GCP project ownership, CSPM contacts, due-date extension process, TFS routing, and organization-specific IAM decisions.

Must-Have 5:
Web and on-premises application vulnerability remediation:
Strong remediation knowledge is required for both web applications and on-premises applications. The candidate must understand common web, API, client-server, middleware, database, and application-server weaknesses; identify the vulnerable code, library, framework, server, operating-system component, protocol, certificate, database configuration, or network dependency; assess exploitability and affected data flow; and provide actionable guidance such as input validation, output encoding, parameterized queries, authentication or authorization correction, dependency or framework upgrades, secret removal, secure header or TLS changes, application-server hardening, service-account correction, database remediation, patching, configuration changes, or retirement of obsolete components.

Must account for legacy-platform constraints, vendor dependencies, service impact, testing, rollback, rescanning, and closure evidence.

Teachable:
Invicti…