AI tools now find vulnerabilities faster than most teams can fix them. You’re the one who fixes them. You’ll take findings from pentests, security audits and scanners and turn them into merged, tested changes, in codebases and infrastructure you didn’t build, without breaking production.
What you’ll do
Fix security findings in client applications: broken access control, authentication and session flaws, injection, insecure data exposure, secrets in code and insecure defaults.
Upgrade outdated frameworks, libraries and runtimes, and handle the breaking changes that come with them.
Fix infrastructure and configuration findings: exposed services, weak TLS, missing security headers, over-permissive IAM and unpatched servers.
Add regression tests for each fix so the same issue can’t come back.
Retest fixes with the security team and write clear notes on what changed and why.
Decide the fix order and technical approach for each set of findings, and estimate the work so clients know the cost and timeline before it starts.
Monitor clients’ dependency trees on an ongoing basis, patch what’s exploitable, and record what was deferred and why.
What you bring
What you bring
Good command of English ( equivalent to IELTS 6.5 & above) is must requirement
7+ years as a software engineer, ideally full-stack, in at least two common languages such as TypeScript, Java, Python, C#, PHP or Go.
Major-version upgrades of frameworks and runtimes in large, existing production codebases.
Secure coding: OWASP Top 10 and OWASP API Security Top 10, OAuth 2.0 and OpenID Connect, JWT pitfalls, session handling, secrets management.
Reproducing and verifying findings with Burp Suite or OWASP ZAP.
Web hardening: TLS configuration, security headers, Content Security Policy, CORS and cookie settings.
SQL and database security: parameterised queries, role design and row-level security.
Cloud and infrastructure basics (AWS, Azure or GCP, Linux, Docker) to fix configuration findings, not just code.
Unit and integration testing to add regression tests for every fix.
AI coding tools such as Claude Code, Cursor or Copilot for working through unfamiliar code.
Nice to have
Experience reading pentest reports or working alongside a security team.
Dependency management tools such as Dependabot, Renovate or Snyk.
Database security: row-level security, role design and query hardening.
A security certification such as Security+, CSSLP or GWEB.
