Full stack Java Developer (React/Node, OWASP Top 10/Vulnerabilities/SAST)

Our Client, a Banking company, is looking for a Full stack Java Developer (React/Node, OWASP Top 10/Vulnerabilities/SAST) for their Plano, TX/Charlotte, NC /Hybrid location.

Responsibilities:

• Own remediation of findings from SAST, SCA/FOSS, DAST, secrets, and API scans, including Checkmarx.
• Analyze CVE, CWE, and CVSS findings to determine exploitability, business impact, and remediation priority.
• Perform root-cause and dependency-chain analysis when vulnerabilities originate from third-party frameworks or packages.
• Fix frontend vulnerabilities in React.js, NPM, MVN, JavaScript, TypeScript, HTML, and CSS, including XSS and insecure client-side patterns.
• Fix backend vulnerabilities in Java/Spring Boot and/or Node.js, including injection, auth/authz flaws, insecure deserialization, SSRF, path traversal, and misconfiguration.
• Upgrade outdated frameworks and libraries, implementing required code changes to fully resolve CVEs rather than relying only on version bumps.
• Replace vulnerable or unsupported libraries with secure alternatives when upgrades are insufficient, including API migration and refactoring.
• Decouple tightly coupled JARs/modules and resolve dependency conflicts across Maven, Gradle, npm, and yarn ecosystems.
• Generate and maintain SBOMs and map components to CVE exposure.
• Validate remediation through build, unit, integration, regression testing, and security rescanning.
• Document remediation evidence, affected components, technical changes, validation results, and closure status.
• Partner with Application Security and infrastructure/platform teams when remediation crosses application boundaries.
• Use SonarQube findings to identify and remediate code-quality and security hotspots, ensuring issues are resolved with code-level fixes before release.
• Own framework/runtime compatibility decisions by validating which Java and Apache dependency versions are supported by the target Spring Boot version before remediation and upgrades.
• Maintain and enforce a version compatibility matrix for Java, Spring Boot, Apache libraries, and build plugins across services.
• Monitor NIST NVD and related vendor advisories for newly published CVEs affecting Java/Spring Boot, React/Node, SQL components, and transitive dependencies.

Requirements:

• Primary Skill
• Core Java
• Secondary Skill
• Spring boot
• Tertiary Skill
• ReactJS
• Required Qualifications
• 8+ years of software development experience.
• 5+ years of hands-on Java development experience.
• 3+ years of hands-on Spring Boot and REST API development.
• 3+ years of full-stack experience with React and Node.js.
• Proven production experience remediating OWASP Top 10/CWE vulnerabilities.
• Checkmarx experience required; equivalent enterprise SAST/SCA tooling accepted only with proven hands-on remediation ownership.
• Strong dependency-management expertise across npm/yarn, package.json, lock files, Maven, and Gradle.
• Proven experience replacing legacy/vulnerable libraries with approved alternatives, including dependency mapping, API migration, compatibility testing, and rollback planning.
• Experience maintaining 100% SBOM coverage for in-scope production releases.
• Experience configuring Maven, Gradle, npm, and yarn to resolve dependencies exclusively through the Bank-approved JFrog repository.
• Hands-on experience with SonarQube (or SonarCloud), including vulnerability triage, quality-gate management, and remediation verification.
• Proven experience with Java and Spring Boot version alignment, including Java 11+ environments, and Apache library compatibility management.
• Strong expertise in Maven/Gradle BOMs, dependency convergence, and resolving version conflicts during CVE remediation.
• Strong Git and Bitbucket experience, including branching strategy, pull requests, code reviews, and merge controls.
• Hands-on CI/CD pipeline experience, including Bitbucket Pipelines and/or enterprise CI/CD tooling.
• Integrate SAST, SCA, secret scanning, SBOM generation, and policy gates into CI/CD.
• Enforce release gates that block unresolved, policy-violating Critical/High issues unless formally risk-approved.
• Automate rescans and remediation verification in pull request and post-merge workflows.
• Enforce controls to block builds when dependencies are pulled from non-approved external repositories.
• Enforce controls to prevent reintroduction of banned/vulnerable libraries and ensure approved replacement libraries are used.
• Apply secure pipeline practices, including least-privilege credentials, protected branches, signed artifacts, and controlled release approvals.
• Integrate SonarQube quality gates into CI/CD and enforce build/merge failures when security or quality thresholds are not met.
• Desired Qualifications
• SQL / Databases: SQL knowledge plus database security concepts, connections, credentials, encryption, and access controls.
• GitHub Copilot experience for secure coding productivity and faster remediation.
• Experience with GitHub Advanced Security, CodeQL, and Dependabot.
• Container and IaC security remediation experience.

Why Should You Apply?

• Health Benefits
• Referral Program
• Excellent growth and advancement opportunities