Application Engineer

Randstad USA; Plano (TX); On-site; USD 75,000 - 89,000; Full time

Job summary

Randstad USA in Plano, TX seeks a senior hands-on developer to identify, analyze, and remediate vulnerabilities across full-stack applications. You will own closure of Critical, High, and Medium findings across frontend React/JS, backend Java/Spring Boot, SQL, APIs, and transitive dependencies, including recent CVEs.

You will lead remediation across SAST/DAST/Secrets, SBOM generation, ensure secure CI/CD, and coordinate with security and infrastructure teams.

Qualifications

• 8+ years of software development experience.
• 5+ years of hands-on Java development experience.
• 3+ years of hands-on Spring Boot and REST API development.
• 3+ years of full-stack experience with React and Node.js.
• Proven production experience remediating OWASP Top 10/CWE vulnerabilities.

Responsibilities

• Own remediation of findings from SAST, SCA/FOSS, DAST, secrets, and API scans, including Checkmarx.
• Analyze CVE, CWE, and CVSS findings to determine exploitability, business impact, and remediation priority.
• Perform root-cause and dependency-chain analysis when vulnerabilities originate from third-party frameworks or packages.
• Fix frontend vulnerabilities in React.js, NPM, MVN, JavaScript, TypeScript, HTML, and CSS, including XSS and insecure client-side patterns.
• Fix backend vulnerabilities in Java/Spring Boot and/or Node.js, including injection, auth/authz flaws, insecure deserialization, SSRF, path traversal, and misconfiguration.

Skills

Java

Spring Boot

React

Node.js

OWASP Top 10

Checkmarx

CI/CD

SBOM

Maven/Gradle

Git/Bitbucket

Education

Bachelor's degree

Tools

Checkmarx

SonarQube

Bitbucket Pipelines

Maven

Gradle

NPM

Yarn

Job description

job summary: Senior hands-on developer responsible for identifying, analyzing, and remediating vulnerabilities across full-stack applications. Primary ownership includes closure of Critical, High, and Medium findings across NPM/ReactJS frontend, Java/Spring Boot backend, SQL/database code, APIs, and direct/transitive dependencies, including newly disclosed CVEs.

location: Plano, Texas. job type: Contract. salary: $54.62 - 64.62 per hour. work hours: 8am to 5pm. education: Bachelors.

Responsibilities

• Own remediation of findings from SAST, SCA/FOSS, DAST, secrets, and API scans, including Checkmarx.
• Analyze CVE, CWE, and CVSS findings to determine exploitability, business impact, and remediation priority.
• Perform root-cause and dependency-chain analysis when vulnerabilities originate from third-party frameworks or packages.
• Fix frontend vulnerabilities in React.js, NPM, MVN, JavaScript, TypeScript, HTML, and CSS, including XSS and insecure client-side patterns.
• Fix backend vulnerabilities in Java/Spring Boot and/or Node.js, including injection, auth/authz flaws, insecure deserialization, SSRF, path traversal, and misconfiguration.
• Upgrade outdated frameworks and libraries, implementing required code changes to fully resolve CVEs rather than relying only on version bumps.
• Replace vulnerable or unsupported libraries with secure alternatives when upgrades are insufficient, including API migration and refactoring.
• Decouple tightly coupled JARs/modules and resolve dependency conflicts across Maven, Gradle, npm, and yarn ecosystems.
• Generate and maintain SBOMs and map components to CVE exposure.
• Validate remediation through build, unit, integration, regression testing, and security rescanning.
• Document remediation evidence, affected components, technical changes, validation results, and closure status.
• Partner with Application Security and infrastructure/platform teams when remediation crosses application boundaries.
• Use SonarQube findings to identify and remediate code-quality and security hotspots, ensuring issues are resolved with code-level fixes before release.
• Own framework/runtime compatibility decisions by validating which Java and Apache dependency versions are supported by the target Spring Boot version before remediation and upgrades.
• Maintain and enforce a version compatibility matrix for Java, Spring Boot, Apache libraries, and build plugins across services.
• Monitor NIST NVD and related vendor advisories for newly published CVEs affecting Java/Spring Boot, React/Node, SQL components, and transitive dependencies.

Required Qualifications

• 8+ years of software development experience.
• 5+ years of hands-on Java development experience.
• 3+ years of hands-on Spring Boot and REST API development.
• 3+ years of full-stack experience with React and Node.js.
• Proven production experience remediating OWASP Top 10/CWE vulnerabilities.
• Checkmarx experience required; equivalent enterprise SAST/SCA tooling accepted only with proven hands-on remediation ownership.
• Strong dependency-management expertise across npm/yarn, package.json, lock files, Maven, and Gradle.
• Proven experience replacing legacy/vulnerable libraries with approved alternatives, including dependency mapping, API migration, compatibility testing, and rollback planning.
• Experience maintaining 100% SBOM coverage for in-scope production releases.
• Experience configuring Maven, Gradle, npm, and yarn to resolve dependencies exclusively through the Bank-approved JFrog repository.
• Hands-on experience with SonarQube (or SonarCloud), including vulnerability triage, quality-gate management, and remediation verification.
• Proven experience with Java and Spring Boot version alignment, including Java 11+ environments, and Apache library compatibility management.
• Strong expertise in Maven/Gradle BOMs, dependency convergence, and resolving version conflicts during CVE remediation.
• Strong Git and Bitbucket experience, including branching strategy, pull requests, code reviews, and merge controls.
• Hands-on CI/CD pipeline experience, including Bitbucket Pipelines and/or enterprise CI/CD tooling.
• Integrate SAST, SCA, secret scanning, SBOM generation, and policy gates into CI/CD.
• Enforce release gates that block unresolved, policy-violating Critical/High issues unless formally risk-approved.
• Automate rescans and remediation verification in pull request and post-merge workflows.
• Enforce controls to block builds when dependencies are pulled from non-approved external repositories.
• Enforce controls to prevent reintroduction of banned/vulnerable libraries and ensure approved replacement libraries are used.
• Apply secure pipeline practices, including least-privilege credentials, protected branches, signed artifacts, and controlled release approvals.
• Integrate SonarQube quality gates into CI/CD and enforce build/merge failures when security or quality thresholds are not met.

Desired Qualifications

SQL / Databases: SQL knowledge plus database security concepts, connections, credentials, encryption, and access controls.

Skills

Apache,MVN,Maven,yarn,APIs,API,backend,Bitbucket,Bitbucket Pipelines,CSS,Checkmarx,refactoring,code reviews,CI/CD pipeline,CI/CD,XSS,database security,database,Databases,frontend,Git,GitHub Copilot,GitHub,Gradle,HTML,Java,Core Java,Java development,Java 11+,JavaScript,Node.js,Node,NPM,OWASP Top 10,ReactJS,React.js,React,regression testing,REST API development,SQL,secure coding,software development,Application Security,SonarQube,Spring Boot,SQL knowledge,SAST,TypeScript,business impact,access controls,Automate,CVSS,compatibility testing,encryption,full-stack applications,full-stack experience,infrastructure,Advanced Security,NIST,security,tooling,triage,vulnerability,workflows

Equal Opportunity Employer

Race, Color, Religion, Sex, Sexual Orientation, Gender Identity, National Origin, Age, Genetic Information, Disability, Protected Veteran Status, or any other legally protected group status.

At Randstad Digital, we welcome people of all abilities and want to ensure that our hiring and interview process meets the needs of all applicants. If you require a reasonable accommodation to make your application or interview experience a great one, please contact [e-mail].

Pay offered to a successful candidate will be based on several factors including the candidate's education, work experience, work location, specific job duties, certifications, etc. In addition, Randstad Digital offers a comprehensive benefits package, including: medical, prescription, dental, vision, AD&D, and life insurance offerings, short-term disability, and a 401K plan (all benefits are based on eligibility).

This posting is open for thirty (30) days.

Required Qualifications8+ years of software development experience.5+ years of hands-on Java development experience.3+ years of hands-on Spring Boot and REST API development.3+ years of full-stack experience with React and Node.js.Proven production experience remediating OWASP Top 10/CWE vulnerabilities.Checkmarx experience required; equivalent enterprise SAST/SCA tooling accepted only with proven hands-on remediation ownership.Strong dependency-management expertise across npm/yarn, package.json, lock files, Maven, and Gradle.Proven experience replacing legacy/vulnerable libraries with approved alternatives, including dependency mapping, API migration, compatibility testing, and rollback planning.Experience maintaining 100% SBOM coverage for in-scope production releases.Experience configuring Maven, Gradle, npm, and yarn to resolve dependencies exclusively through the Bank-approved JFrog repository.Hands-on experience with SonarQube (or SonarCloud), including vulnerability triage, quality-gate management, and remediation verification.Proven experience with Java and Spring Boot version alignment, including Java 11+ environments, and Apache library compatibility management.Strong expertise in Maven/Gradle BOMs, dependency convergence, and resolving version conflicts during CVE remediation.Strong Git and Bitbucket experience, including branching strategy, pull requests, code reviews, and merge controls.Hands-on CI/CD pipeline experience, including Bitbucket Pipelines and/or enterprise CI/CD tooling.Integrate SAST, SCA, secret scanning, SBOM generation, and policy gates into CI/CD.Enforce release gates that block unresolved, policy-violating Critical/High issues unless formally risk-approved.Automate rescans and remediation verification in pull request and post-merge workflows.Enforce controls to block builds when dependencies are pulled from non-approved external repositories.Enforce controls to prevent reintroduction of banned/vulnerable libraries and ensure approved replacement libraries are used.Apply secure pipeline practices, including least-privilege credentials, protected branches, signed artifacts, and controlled release approvals.Integrate SonarQube quality gates into CI/CD and enforce build/merge failures when security or quality thresholds are not met.Desired QualificationsSQL / Databases: SQL knowledge plus database security concepts, connections, credentials, encryption, and access controls.Gi