> Markdown version of [/jobs/ext/2007590-vulnerability-management-application-security-liaison-spoc](https://www.wearedevelopers.com/jobs/ext/2007590-vulnerability-management-application-security-liaison-spoc). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Vulnerability Management & Application Security Liaison SPOC

- **Company:** Delan Associates, Inc
- **Location:** Woodbridge Township, NJ, United States
- **Experience:** Experienced
- **Contract:** Temporary contract
- **Skills:** Microsoft Windows, Artificial Intelligence, Apache HTTP Server, Apache Tomcat, Automation of Tests, Cyber Security, Databases, Continuous Integration, Linux, DevOps, Middleware, IBM Websphere Application Server, PostgreSQL, Microsoft SQL Server, Windows Servers, OpenShift, Oracle (Applications), Service Pack, Software Testing Automation Framework, Software Vulnerability Management, Software Security, Checkmarx, Devsecops, Servicenow, Static Application Security Testing
- **Published:** August 9, 2026
- **Apply:** https://www.wayup.com/i-j-Vulnerability-Management-Application-Security-Liaison-SPOC-Delan-Associates-Inc-539830124608181/

## About the Role

AppSec Tooling: Foundational knowledge 3+ years managing workflows in Checkmarx (SAST) and Black Duck (SCA).
Infrastructure Stack: Strong foundational knowledge of Linux, Windows Server, OpenShift Container Platform (OCP), databases, and middleware technologies.
Modern Engineering Frameworks: Practical understanding of Internal Developer Platforms (IDPs) and DevSecOps pipelines.
Automation & AI: Direct experience tracking or managing test automation frameworks and AI-assisted coding/security tools.

## Description

Analyze infrastructure-adjacent flaws by applying a solid understanding of Linux and Windows operating system vulnerabilities.
Oversee containerized security within OpenShift Container Platform (OCP), ensuring image scanning findings are triaged effectively.
Collaborate on data-layer risk, tracking and managing vulnerabilities related to databases (e.g., Oracle, SQL Server, PostgreSQL) and core middleware components (e.g., Apache, Tomcat, WebSphere).
Cross-reference application flaws (Checkmarx/Black Duck) with host-level and container-level vulnerabilities to determine the true, contextual runtime risk.
Automation & Platform Transformation
Track IDP Adoption: Partner with Platform Engineering to ensure development squads migrate to the Internal Developer Platform, standardizing secure guardrails.
Measure AI Security Adoption: Track and report metrics on how effectively developers utilize AI-driven security companions to triage and fix code flaws.
Govern Test Automation: Collaborate with QA and DevOps to embed automated security gates seamlessly into continuous integration pipelines.
Continuous Monitoring: Build dashboards that display automation maturity, remediation velocity, and the reduction of manual security operations. [1]
Cross-Functional Orchestration & Governance
Act as the primary SPOC aligning App Dev, AppSec, and Production Support teams to prioritize and resolve software flaws.
Enforce remediation SLAs ensuring security patches are delivered according to corporate compliance and risk thresholds.
Govern the Exception Management workflow, reviewing developer risk-acceptance requests and documenting temporary business justifications.
Integrate security fixes with Change Management protocols (e.g., ServiceNow) to ensure production support stability remains intact during deployments.
Local & Hybrid Expectations
Work Structure: 2-3 days on-site, 2-3 days remote (Hybrid).
Location Options: Iselin, NJ (Metropark) or Charlotte, NC (Corporate Hub).


## Related Videos

- [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers)
- [DevSecOps: Injecting Security into Mobile CI/CD Pipelines](https://www.wearedevelopers.com/videos/273-devsecops-injecting-security-into-mobile-ci-cd-pipelines)
- [Docker network without Docker](https://www.wearedevelopers.com/videos/1418-docker-network-without-docker)
- [From DevOps to Scaled DevOps: How We’re Rebuilding Continuous Delivery as a Platform](https://www.wearedevelopers.com/videos/100018-from-devops-to-scaled-devops-how-we-re-rebuilding-continuous-delivery-as-a-platform)
- [DevSecOps culture](https://www.wearedevelopers.com/videos/783-devsecops-culture)
- [You can’t hack what you can’t see](https://www.wearedevelopers.com/videos/41-you-can-t-hack-what-you-can-t-see)

## Related Articles

- [Walking Into The Era of Supply Chain Risks](https://www.wearedevelopers.com/magazine/106-walking-into-the-era-of-supply-chain-risks)
- [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities)
- [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed)
- [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing)
- [Dev Digest 138 - Are you secure about this?](https://www.wearedevelopers.com/magazine/486-dev-digest-138-are-you-secure-about-this)
- [Dev Digest 191: Malware interviews, EU ❤️ Open Source and Skilled Agents](https://www.wearedevelopers.com/magazine/645-dev-digest-191-malware-interviews-eu-open-source-and-skilled-agents)