Vulnerability Management & Application Security Liaison SPOC

Delan Associates, Inc; Woodbridge Township, Charlotte (NJ, NC); Hybrid; USD 110,000 - 150,000; Full time

Job summary

Delan Associates, Inc is seeking a seasoned security professional to lead infrastructure and application security across a hybrid on-site/remote environment in Iselin, NJ or Charlotte, NC. You will own vulnerability management, automate security gates, collaborate with App Dev, AppSec, and Production Support, and drive secure platform transformations leveraging OpenShift, Checkmarx, and Black Duck.

Applicants must have 10+ years experience, GC or USC status, and be able to thrive in a

Qualifications

• 10+ years of experience in application and infrastructure security.
• Strong knowledge of Linux, Windows, OpenShift, databases, and middleware.
• Experience with IDPs, DevSecOps, and secure software development practices.

Responsibilities

• Analyze infrastructure-adjacent flaws by applying a solid understanding of Linux and Windows operating system vulnerabilities.
• Oversee containerized security within OpenShift Container Platform (OCP), ensuring image scanning findings are triaged effectively.
• Collaborate on data-layer risk, tracking and managing vulnerabilities related to databases (e.g., Oracle, SQL Server, PostgreSQL) and core middleware components (e.g., Apache, Tomcat, WebSphere).
• Cross-reference application flaws (Checkmarx/Black Duck) with host-level and container-level vulnerabilities to determine the true, contextual runtime risk.
• Track IDP Adoption: Partner with Platform Engineering to ensure development squads migrate to the Internal Developer Platform, standardizing secure guardrails.
• Measure AI Security Adoption: Track and report metrics on how effectively developers utilize AI-driven security companions to triage and fix code flaws.
• Govern Test Automation: Collaborate with QA and DevOps to embed automated security gates seamlessly into continuous integration pipelines.
• Continuous Monitoring: Build dashboards that display automation maturity, remediation velocity, and the reduction of manual security operations.
• Act as the primary SPOC aligning App Dev, AppSec, and Production Support teams to prioritize and resolve software flaws.
• Enforce remediation SLAs ensuring security patches are delivered according to corporate compliance and risk thresholds.
• Govern the Exception Management workflow, reviewing developer risk-acceptance requests and documenting temporary business justifications.
• Integrate security fixes with Change Management protocols (e.g., ServiceNow) to ensure production support stability remains intact during deployments.

Skills

Linux

Windows Server

OpenShift

DevSecOps

SAST/SCA tooling

Tools

Checkmarx

Black Duck

ServiceNow

OpenShift

Job description

Experience: 10+

Contract: Long Term

Only GC, USC

Expanded Key Responsibilities

Infrastructure & Full-Stack Triage

Analyze infrastructure-adjacent flaws by applying a solid understanding of Linux and Windows operating system vulnerabilities.

Oversee containerized security within OpenShift Container Platform (OCP), ensuring image scanning findings are triaged effectively.

Collaborate on data-layer risk, tracking and managing vulnerabilities related to databases (e.g., Oracle, SQL Server, PostgreSQL) and core middleware components (e.g., Apache, Tomcat, WebSphere).

Cross-reference application flaws (Checkmarx/Black Duck) with host-level and container-level vulnerabilities to determine the true, contextual runtime risk.

Automation & Platform Transformation

Track IDP Adoption: Partner with Platform Engineering to ensure development squads migrate to the Internal Developer Platform, standardizing secure guardrails.

Measure AI Security Adoption: Track and report metrics on how effectively developers utilize AI-driven security companions to triage and fix code flaws.

Govern Test Automation: Collaborate with QA and DevOps to embed automated security gates seamlessly into continuous integration pipelines.

Continuous Monitoring: Build dashboards that display automation maturity, remediation velocity, and the reduction of manual security operations. [1]

Cross-Functional Orchestration & Governance

Act as the primary SPOC aligning App Dev, AppSec, and Production Support teams to prioritize and resolve software flaws.

Enforce remediation SLAs ensuring security patches are delivered according to corporate compliance and risk thresholds.

Govern the Exception Management workflow, reviewing developer risk-acceptance requests and documenting temporary business justifications.

Integrate security fixes with Change Management protocols (e.g., ServiceNow) to ensure production support stability remains intact during deployments.

Local & Hybrid Expectations

Work Structure: 2-3 days on-site, 2-3 days remote (Hybrid).

Location Options: Iselin, NJ (Metropark) or Charlotte, NC (Corporate Hub).

Qualifications & Skills

Technical Requirements

AppSec Tooling: Foundational knowledge 3+ years managing workflows in Checkmarx (SAST) and Black Duck (SCA).

Infrastructure Stack: Strong foundational knowledge of Linux, Windows Server, OpenShift Container Platform (OCP), databases, and middleware technologies.

Modern Engineering Frameworks: Practical understanding of Internal Developer Platforms (IDPs) and DevSecOps pipelines.

Automation & AI: Direct experience tracking or managing test automation frameworks and AI-assisted coding/security tools.