Note: The job is a remote job and is open to candidates in USA. Marlabs is seeking a Senior Application Security Engineer to support data engineering, application security, and cloud modernization initiatives across multiple technical application teams. The role focuses on remediating vulnerabilities, modernizing Java applications, improving Azure infrastructure and CI/CD automation, implementing security controls, and coordinating secure cloud migration and operational readiness efforts.
Responsibilities
- Serve as a centralized engineering resource shared across multiple technical application teams, balancing priorities, coordinating dependencies, and supporting concurrent remediation and modernization efforts
- Design, test, debug, implement dynamic applications and user interfaces using Java and PrimeFaces
- Maintain Java applications and services in Microsoft Azure
- Work with users to understand requirements then elicit feedback and refine solution through demonstrations
- Present the solution at formal and informal design reviews and document the design
- Strong initiative: must be able to take a high-level requirement, ask questions, seek clarifications, and get the job done
- Support application security and cloud modernization initiatives including vulnerability remediation, secrets remediation, credential lifecycle enforcement, WAF implementation readiness, secure image adoption, CI/CD pipeline automation, cloud tagging, observability, and policy guardrail implementation
- Analyze security dashboards, vulnerability findings, scan results, and exception requests to prioritize remediation activities and identify false positives, compensating controls, and required application changes
- Develop and update automation scripts, deployment pipelines, infrastructure-as-code modules, and remediation utilities using tools such as Terraform, Ansible, Jenkins, GitHub Actions, or similar platforms
- Implement or support secure application patterns including managed services, containerization, serverless migration, automated patching, Chainguard base images, least-privilege access, and secrets management integrations
- Partner with application owners to prepare WAF implementations by validating application inventories, DNS dependencies, audit-mode readiness, policy visibility, security event logging, and Sentinel integration requirements
- Provision, configure, and validate non-production and production cloud environments, including networking dependencies, access controls, deployment readiness, tagging, monitoring, and security baseline requirements
- Validate application inventories, ownership records, system dependencies, and remediation accountability to support prioritization, implementation planning, and audit readiness
- Support remediation of batch operations, legacy workloads, scheduled processing, and related infrastructure dependencies while coordinating with operations teams to minimize production impact
- Plan and execute regression testing after remediation activities such as patching, dependency upgrades, secure image adoption, WAF policy changes, configuration updates, and cloud migration work
- Produce technical documentation, remediation evidence, design notes, developer guidance, runbooks, and status updates needed for implementation tracking, audit readiness, and leadership reporting
Skills
- Experience as Senior Developer on large web application UI's from start to finish
- Expertise with Java, JavaScript, Spring, Hibernate, JSON, HTML4/5, AJAX, JSF, CSS, JDBC
- Experience with Eclipse (or alternates: IntelliJ, VS Code), Jira, and Git for design, development, and testing
- Extensive JavaScript framework experience (ex. Angular JS, Bootstrap)
- Experience writing and consuming web services (SOAP/RESTful)
- Experience with web security, WAF, OAuth, HTTP/s, HSTS, etc
- Experience in Java Web Containers (Tomcat etc.)
- Experience migrating applications to cloud infrastructure (Azure, AWS, OpenStack)
- Experience writing deployment scripts (Ansible, Terraform, Jenkins)
- Experience working with customers and team members to define requirements and demonstrate solutions
- Experience designing and delivering complex, highly scalable software components
- Experience utilizing various debugging tools and methodologies for debugging UI and components
- Experience with vulnerability management tools and processes, including interpreting findings from scanners and security platforms, prioritizing P1-P4 vulnerabilities, validating remediation, and documenting exceptions
- Hands-on experience with secrets remediation and credential lifecycle controls, including AWS access keys, Azure service principal credentials, credential rotation, least-privilege access, and integration with approved secrets management solutions
- Experience with secure CI/CD practices, pipeline scanning, policy-as-code, infrastructure-as-code, automated deployment controls, and developer workflow integration for security tools such as Wiz Code, Mend, Snyk, Dependabot, JFrog Artifactory, or similar platforms
- Experience implementing or supporting WAF solutions and related security controls, including Cloudflare, Imperva, Radware, AWS WAF, Azure WAF, policy management, management console access, security event logging, and Microsoft Sentinel integration
- Experience with container security, hardened base images, ChandiGuard or equivalent secure images, automated patching, dependency upgrades, regression testing, and migration from VM-based workloads to PaaS, containers, serverless, or managed services where appropriate
- Experience provisioning and validating Azure infrastructure across non-production and production environments, including network configuration, identity and access controls, resource tagging, deployment pipelines, monitoring, and security baseline validation
- Experience supporting application inventory cleanup, ownership validation, dependency mapping, server fingerprinting, remediation tracking, dashboard validation, and evidence repository maintenance
- Experience supporting migration, modernization, or decommissioning of legacy workloads, including evaluating VM-based applications for managed services, containers, serverless platforms, or retirement where appropriate
- Experience supporting cloud governance and inventory controls, including resource tagging, ownership identification, server fingerprinting, dashboard validation, logging, monitoring, observability, and audit evidence collection
- Bachelor's degree or equivalent experience
- 5+ years of software development, coding, and scripting experience
- 5+ yrs. Cloud / Azure Development experience required
- Experience in Linux environment and Windows?
- 5+ yrs. Java, HTML, JavaScript and framework libraries required
- Experience remediating application, infrastructure, dependency, container image, secrets, and cloud configuration vulnerabilities across Java, Linux, Windows, AWS, Azure, and GitHub environments
- Experience working with information security, platform engineering, DevOps, SRE, application development, and project management teams to deliver security remediation outcomes
- Experience working in a shared-services or centralized delivery model, supporting multiple application teams, managing competing priorities, and coordinating across diverse technical stakeholders
- Experience supporting operational handoff and production readiness activities, including runbooks, support models, monitoring, escalation paths, release coordination, and transition to steady-state support
- Tomcat based environment is preferred
Benefits
- Remote work arrangement, with an in-office verification requirement if hired
Company Overview
Company H1B Sponsorship