Security & Developer Team Lead

Serves as the technical and application-security lead for the remediation squad. Owns vulnerability review and rationalization, CVE/CWE analysis, false-positive validation, prioritized backlog development, secure remediation strategy, complex code changes, peer review, rescanning, and technical coordination with repository owners.

7-10+ years of full stack software development or application security experience

5+ years serving as a technical lead, senior engineer, AppSec lead, or secure-development lead

Demonstrated experience remediating application vulnerabilities in .NET and JavaScript/TypeScript ecosystems

Hands-on experience interpreting SAST and SCA findings and validating false positives

Experience leading secure code review, dependency remediation, testing, and release coordination

Experience working across multiple repositories and application teams in a regulated or enterprise environment

Core Technical Competencies

Application Security and secure software development

GitLab Ultimate security scanning and governance

SAST and Software Composition Analysis

CVE/CWE analysis, exploitability assessment, and risk prioritization

OWASP Top 10 and secure coding patterns

Vulnerability deduplication and false-positive validation

Full stack remediation across .NET, Node.js, React, JavaScript, and TypeScript

NuGet and NPM dependency management

Open-source licensing awareness and remediation planning

Technical backlog creation, sequencing, and validation

Required Hard Skills

C#, .NET Framework, .NET Core, and modern .NET

JavaScript, TypeScript, Node.js, and React

GitLab Ultimate security features, GitLab CI/CD, Git, and merge-request workflows

SAST/SCA finding analysis and repository rescanning

Secure code review, root-cause analysis, and remediation design

NuGet/NPM package analysis and dependency upgrades

Unit, integration, regression, and remediation-validation testing

REST APIs, SQL Server, build troubleshooting, and pipeline diagnostics

Ability to evaluate MIT, BSD, Apache, copyleft, and other dependency-license implications against Client standards