Role Summary
We are seeking a hands-on Full Stack Developer to design, build, and continuously evolve a suite of internal security tools and platforms — including Vulnerability Management (VM), Web Application Security (WAS) scanning orchestration, SAST/SCA/DAST integrations, threat intelligence aggregation, asset and attack-path modeling, and Secure SDLC tooling. The successful candidate will engineer scalable, well-tested, end-to-end web applications that empower security engineers, developers, and risk stakeholders across the organization to identify, triage, and remediate security risk faster. You will work at the intersection of application engineering and security engineering, embedding security automation into developer workflows and cloud platforms.
Goals & Objectives-
Build and continuously improve an internal security tooling platform that consolidates vulnerability data, scan results, asset context, and remediation workflows into a single source of truth.
-
Develop and maintain the Vulnerability Management (VM) application — including ingestion pipelines, normalization, deduplication, risk scoring (CVSS/EPSS/contextual), SLA tracking, and reporting dashboards over very large finding datasets.
-
Engineer the Web Application Security (WAS) tooling — orchestration of DAST scans, authenticated scan profiles, scan scheduling, finding triage workflows, and developer ticketing integrations (Jira, Azure DevOps, GitHub Issues).
-
Integrate SAST, SCA, secrets-scanning, IaC scanning, and container-image scanning tools into CI/CD pipelines, and surface results through the security platform.
-
Model assets, identities, and relationships as a graph to power blast-radius and attack-path analysis used by remediation workflows.
-
Reduce manual effort for the security team by automating recurring workflows (ticket creation, exception management, evidence collection, compliance evidence) using durable workflow orchestration.
-
Partner with the AppSec and Cloud Security teams to operationalize Secure SDLC controls (threat modeling intake, security requirements, gating policies, paved-road templates).
-
Deliver a high-quality developer and analyst experience: fast, intuitive UIs handling high-cardinality data; reliable APIs; well-documented integrations; observable, resilient services.
-
Champion engineering best practices — code quality, automated testing, performance, accessibility, and security-by-design in everything we build.
Key Responsibilities
Full Stack Development-
Design, develop, test, deploy, and maintain end-to-end features across frontend, backend, and data layers for the security tooling platform.
-
Build responsive, accessible web UIs using React with TypeScript, virtualized data grids, charting libraries, and real-time updates (WebSockets / Server-Sent Events) for scan progress and live findings.
-
Develop scalable backend services and REST APIs (OpenAPI-first) using Python (FastAPI/Django) or Node.js — including authentication, authorization (RBAC/ABAC), and audit logging.
-
Design relational, document, search, and analytical data models — PostgreSQL for operational data, OpenSearch/Elasticsearch for finding search, and a columnar store (ClickHouse, Snowflake, BigQuery, or Iceberg/Parquet) for analytics over billions of findings.
-
Build event-driven and batch data pipelines for ingesting scanner output, asset inventory, ticketing data, and threat intelligence feeds.
-
Implement durable workflow orchestration for scan lifecycle, ticket lifecycle, SLA timers, and evidence collection.
