Senior Developer

NTT Data; Plano (AL); On-site; USD 120,000 - 180,000; Full time

Job summary

NTT DATA in Plano, Texas is seeking a Senior Developer to join a security-focused team. You will drive vulnerability management across web, on-premises, and cloud environments, validating findings and coordinating remediation with asset owners.

The role emphasizes building clear vulnerability reporting, dashboards, and a disciplined closure process with documented validation, timelines, and risk reduction. Collaboration with DevSecOps and cross-functional partners is essential.

Qualifications

• Must demonstrate technical judgment in validating findings, remediation evidence, and risk assessment.
• Strong hands-on vulnerability remediation expertise across systems and applications.
• Deep experience interpreting Qualys server findings and determining remediation at OS, package, service, or config level.
• Experience with Wiz and GCP cloud-risk analysis and applying least-privilege IAM changes.
• Broad remediation knowledge for web and on-premises applications, including security controls and hardening.
• Ability to translate scanner output into actionable remediation plans with owners and dates.
• Experience designing vulnerability reports and dashboards with accurate metrics and trends.

Responsibilities

• Translate scanner output into actionable remediation plans with clear ownership and target dates.
• Drive remediation through verified closure with validation and rollback steps.
• Develop and maintain vulnerability dashboards and reports with accurate data and trends.
• Coordinate across application, infrastructure, cloud, and DevSecOps teams for remediation.
• Validate affected assets and ensure proper patching, configuration changes, or isolation actions.

Skills

Technical judgment and reporting

Remediation operations

Qualys server analysis

Wiz and GCP remediation

Web and on-prem remediation

Remediation coordination

Vulnerability reporting & dashboards

Tools

Qualys

Wiz

Terraform

Job description

We are currently seeking a Senior Developer to join our team in Plano, Texas (US-TX), United States (US).

JD for - GD Offshore - Senior Developer:

Skill Area:
Must-Have 1: Technical judgment, false-positive review, and findings reporting:
Can technically validate findings and remediation evidence, distinguish symptoms from root cause, identify direct and transitive dependencies, verify whether a vulnerable component is loaded, reachable, or exploitable, recognize obsolete or shared assets, evaluate compensating controls, and determine whether remediation, false-positive closure, deferral, or risk acceptance is appropriate. Must also be able to build clear, accurate vulnerability reporting around findings, including severity, exploitability, affected assets and applications, ownership, remediation actions, target dates, aging, exceptions, closure evidence, trends, and business risk. Must not close a finding based only on owner confirmation or a completed ticket.

Teachable / Learn During Onboarding:
evidence expectations, systems of record, ownership mappings, reporting templates, department and ADM groupings, distribution lists, risk-acceptance authorities, and reporting cadence.

Must-Have 2: Vulnerability management operations:
Strong hands-on vulnerability remediation expertise is required. The candidate must be able to interpret a finding, identify the vulnerable component and attack path, determine the actual exposure and business impact, distinguish the root cause from the scan symptom, select the correct technical remediation, identify the implementation owner, define validation and rollback steps, and drive the issue through verified closure. Tracking alone is not sufficient.

Teachable:
remediation timelines, dispatch-sheet structure, application portfolio, reporting cadence, and stakeholder map.

Must-Have 3: Qualys server vulnerability analysis:
Deep experience interpreting Qualys server findings and determining the correct remediation at the operating-system, package, service, configuration, protocol, certificate, or network-control level. Must validate affected assets and installed versions, distinguish server findings from application issues, evaluate exploitability and compensating controls, recognize false positives, and specify patching, upgrades, configuration changes, service retirement, or isolation steps with validation and rollback requirements.

Teachable:
Qualys dispatch process, server ownership sources, application mapping, internal remediation teams, and risk-acceptance workflow.

Must-Have 4: Wiz and GCP cloud-risk analysis:
Strong Wiz and GCP cloud-remediation skills are required. The candidate must interpret the affected resource, toxic combination or attack path, IAM and network exposure, data sensitivity, and runtime context; then determine the appropriate least-privilege IAM change, configuration correction, network restriction, encryption or logging control, resource replacement, or Terraform change. Must evaluate inheritance, organizational constraints, downstream impact, and validation before recommending implementation.

Teachable:
Wiz dashboards, GCP project ownership, CSPM contacts, due-date extension process, TFS routing, and organization-specific IAM decisions.

Must-Have 5: Web and on-premises application vulnerability remediation:
Strong remediation knowledge is required for both web applications and on-premises applications. The candidate must understand common web, API, client-server, middleware, database, and application-server weaknesses; identify the vulnerable code, library, framework, server, operating-system component, protocol, certificate, database configuration, or network dependency; assess exploitability and affected data flow; and provide actionable guidance such as input validation, output encoding, parameterized queries, authentication or authorization correction, dependency or framework upgrades, secret removal, secure header or TLS changes, application-server hardening, service-account correction, database remediation, patching, configuration changes, or retirement of obsolete components. Must account for legacy-platform constraints, vendor dependencies, service impact, testing, rollback, rescanning, and closure evidence.

Teachable:
Invicti dispatch format, application ownership hierarchy, department reporting structure, and local escalation contacts.

Must-Have 6: Remediation coordination and ownership:
Can translate scanner output into a technically complete remediation plan for application, infrastructure, cloud, vendor, CSPM, and DevSecOps teams. The plan must identify the required change, implementation owner, dependencies, service and security impact, testing, rollback, target date, closure evidence, and escalation path. The candidate must challenge vague responses such as “will patch” or “team is reviewing” and obtain an executable plan.

Teachable:
support groups, application contacts, vendor engagement process, ticket queues, escalation path, and communication templates.

Must-Have 7: Vulnerability reporting, dashboard development, and data-quality validation:
Can design, build, and maintain actionable vulnerability reports and dashboards—not only review existing output. Reporting must reconcile source data and clearly show findings by severity, exploitability, application or asset, owner, remediation action, target date, age, overdue status, exception or risk-acceptance status, closure evidence, trends, and business impact. Must identify incorrect metrics, mixed or missing source data, duplicates, ownership gaps, and inconsistent totals before distribution.

Teachable:
weekly email layouts, department and ADM groupings, source spreadsheets, distribution lists, and report-production schedule.

Secondary 1: Terraform remediation support:
Working ability to understand Terraform-related cloud remediation, recognize when role or configuration changes require engineering support, and route actionable work to the DevSecOps Run Team.

Teachable:
Terraform repositories, approved modules, pull-request process, internal support boundaries, and TFS assignment conventions.

Secondary 2: Reporting automation validation:
Can test automated report output, compare it with source data, identify logic or mapping defects, and provide precise correction requirements.

Teachable:
Power Automate flows, report scripts, schedules, source connections, and ownership for code corrections.

Secondary 3: Knowledge transfer and operational continuity:
Can document recurring work, explain dashboards and follow-up procedures, share active issues, and prepare another engineer to take over daily responsibilities.

Teachable:
documentation locations, working-hour coverage, recurring meeting schedule, active application list, and team communication practices.
Teachable: Internal application and process knowledge:
Not required at hire.

Teachable:
applications, dispatch sheets, ADM and department structure, Qualys and Wiz ownership mapping, TFS workflows, CSPM guidance paths, report distribution, risk-acceptance process, and internal contacts.

About NTT DATA

NTT DATA is a $30 billion business and technology services leader, serving 75% of the Fortune Global 100. We are committed to accelerating client success and positively impacting society through responsible innovation. We are one of the world's leading AI and digital infrastructure providers, with unmatched capabilities in enterprise-scale AI, cloud, security, connectivity, data centers and application services. our consulting and Industry solutions help organizations and society move confidently and sustainably into the digital future. As a Global Top Employer, we have experts in more than 50 countries. We also offer clients access to a robust ecosystem of innovation centers as well as established and start-up partners. NTT DATA is a part of NTT Group, which invests over $3 billion each year in R&D.

Whenever possible, we hire locally to NTT DATA offices or client sites. This ensures we can provide timely and effective support tailored to each client’s needs. While many positions offer remote or hybrid work options, these arrangements are subject to change based on client requirements. For employees near an NTT DATA office or client site, in-office attendance may be required for meetings or events, depending on business needs. At NTT DATA, we are committed to staying flexible and meeting the evolving needs of both our clients and employees. NTT DATA recruiters will never ask for payment or banking information and will only use @nttdata.com, @nttdatafed.com and @talent.nttdataservices.com email addresses. If you are requested to provide payment or disclose banking information, please submit a contact us form, https://us.nttdata.com/en/contact-us.

NTT DATA endeavors to make https://us.nttdata.com accessible to any and all users. If you would like to contact us regarding the accessibility of our website or need assistance completing the application process, please contact us at https://us.nttdata.com/en/contact-us. This contact information is for accommodation requests only and cannot be used to inquire about the status of applications. NTT DATA is an equal opportunity employer. Qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability or protected veteran status. For our EEO Policy Statement, please click here. If you'd like more information on your EEO rights under the law, please click here. For Pay Transparency information, please click here.