Application Security Engineer (Java)

At Cafeto Software, we re looking for an Application Security Engineer with a strong Java background to strengthen the security posture of an enterprise application for a US-based pricing software company. You ll identify, prioritize, and fix vulnerabilities across the codebase, its dependencies, and its delivery pipeline.

What you’ll do

• Triage and remediate security vulnerabilities and CVEs reported by scanning tools.
• Upgrade libraries, frameworks, and dependencies, resolving breaking changes.
• Refactor code to eliminate insecure patterns such as injection, unsafe deserialization, and weak cryptography.
• Write tests that verify fixes and prevent regressions.
• Document findings and track progress with security and engineering stakeholders.

What we’re looking for

• 3 to 5 years of backend experience, primarily in Java.
• Experience managing dependencies in Maven or Gradle projects.
• Working knowledge of OWASP Top 10, CVE/CVSS, and secure coding practices.
• Advanced English and the ability to work with distributed teams across US time zones.

Nice to have

• Snyk, Mend, Dependabot, SonarQube, or Trivy.
• Spring, Dropwizard, Jersey, or Hibernate.
• Docker, Kubernetes, or Azure DevOps.