IT Application Vulnerability Patch Specialist

岗位职责
1、Act as the primary point of contact for external supplier development teams regarding vulnerability remediation for assigned Java/J2EE applications;
Assign vulnerability remediation tasks to suppliers with clear priorities, timelines, and acceptance criteria;
2、Monitor supplier progress against agreed SLAs and remediation deadlines; escalate delays or non-compliance to management and vendor governance as appropriate;
3、Organize and lead regular status meetings with suppliers to review open vulnerabilities, patch progress, blockers, and upcoming patching windows;
4、Review and validate supplier-submitted remediation plans, including proposed dependency upgrades, code changes, and configuration modifications;
5、Maintain a tracker of all open vulnerabilities and associated supplier commitments, ensuring accurate and up-to-date reporting;
6、Review vulnerability scan results, software composition analysis findings, and vendor security advisories to understand affected Java applications and their severity;
7、Prioritize vulnerabilities based on CVSS score, exploitability, asset criticality, and business impact, in collaboration with internal security and application owners;
8、Communicate vulnerability details, required fixes, and deadlines clearly to supplier teams, ensuring they have sufficient technical context;
9、Review supplier-proposed code changes and configuration modifications (e、g、, pom、xml dependency upgrades, Spring configuration changes, Tomcat settings) to ensure they correctly address the identified vulnerabilities without introducing new risks;
10、Challenge supplier remediation approaches when they are incomplete, inconsistent, or fail to follow secure coding standards;
11、Verify that supplier testing (unit tests, integration tests, smoke tests) has been adequately performed before approving deployment to higher environments;
12、Conduct post-deployment verification by reviewing vulnerability re-scan results and confirming vulnerabilities are fully closed;
13、Ensure suppliers document all changes, including rollback plans, in accordance with the organization’s change management process;
14、Coordinate patching windows with suppliers, internal infrastructure teams, application owners, and business stakeholders to minimize operational disruption;
15、Review and approve supplier-raised change requests, ensuring they contain adequate risk assessment, implementation steps, rollback procedures, and test evidence;
16、Track deployment outcomes and follow up on any failed deployments or rollbacks with the supplier until resolution;
17、Ensure emergency/out-of-band patches for critical zero-day vulnerabilities are expedited through the change process with appropriate approvals;
18、Produce regular reports on vulnerability remediation status, supplier performance, overdue patches, and risk exposure for management and governance forums;
19、Maintain evidence of vulnerability closure for audit and compliance purposes;
20、Track supplier performance metrics such as on-time delivery, patch acceptance rate, rework rate, and defect leakage;
21、Support internal and external audits by providing documentation and walkthroughs of the supplier patch management process;
22、Work closely with internal application owners to understand business priorities and constraints affecting patching schedules;
23、Collaborate with internal security teams to interpret vulnerability requirements and ensure supplier fixes meet security standards;
24、Escalate risks, blockers, and supplier performance issues to senior management, vendor management, or procurement as needed;
25、Facilitate communication between suppliers and internal teams to resolve technical questions or environment-related blockers.

岗位要求
1、Ability to read and understand Java source code, exception stack traces, and application logs to assess the quality of supplier fixes;
2、Knowledge of Java memory management, class loading, and dependency resolution to evaluate potential impacts of supplier changes;
3、Working knowledge of Spring Framework: Spring Core, Spring MVC, Spring Boot, Spring Security, Spring Data, Spring AOP, and Spring Batch;
4、Ability to review Spring configuration files (XML and Java-based @Configuration) and understand the impact of changes proposed by suppliers;
5、Familiarity with Spring Boot auto-configuration, externalized configuration, and dependency management;
6、Understanding of Spring Security configuration and common misconfigurations that lead to vulnerabilities;
7、Proficiency in reading and reviewing Maven (pom、xml) and Gradle (build、gradle) build files, including dependency declarations, plugin configurations, and version properties;
8、Ability to assess dependency upgrade impacts, including transitive dependencies and version conflicts;
9、Experience using software composition analysis tools such as Snyk, OWASP Dependency-Check, WhiteSource/Mend, Black Duck, or similar to identify vulnerable libraries;
10、Hands-on knowledge of Apache Tomcat configuration and deployment, including server、xml, context、xml, web、xml, JNDI resources, and data sources;
11、Understanding of WAR/EAR artifact structure and deployment processes;
12、Familiarity with CI/CD pipelines (Jenkins, GitLab CI, Azure DevOps) used by suppliers for building and deploying Java applications;
13、Proficient with Git and code review platforms such as GitLab, GitHub, or Bitbucket;
14、Ability to review supplier merge requests or pull requests for security patches, identifying incomplete or incorrect changes;
15、Deep understanding of common Java-related vulnerabilities and their remediation (e、g、, Log4Shell, Spring4Shell, deserialization flaws, XXE, SSRF, SQL injection);
16、Familiarity with static application security testing (SAST) results and ability to interpret findings for supplier guidance;
17、Understanding of secure session management, TLS configuration, and Java security controls;
18、Autonomy: Works under general direction with discretion to manage supplier relationships and prioritize remediation activities、 Escalates high-risk or unresolved supplier performance issues as appropriate;
19、Influence: Influences external supplier teams and internal stakeholders without direct line authority、 Uses technical credibility and process governance to drive timely remediation;
20、Complexity: Manages multiple applications, suppliers, and vulnerability remediation streams simultaneously、 Applies a methodical approach to tracking, reviewing, and verifying supplier work;
21、Knowledge: Has sound technical knowledge of Java/J2EE, Spring, Tomcat, build tools, and application security to effectively oversee supplier remediation、 Understands the broader business and regulatory context of vulnerability management;
22、Business skills: Demonstrates strong communication, negotiation, and stakeholder management skills、 Plans, schedules, and monitors supplier deliverables within tight deadlines、 Applies analytical and systematic approaches to evaluating supplier work and resolving issues;
23、Bachelor of Science degree from an accredited college or university with a concentration in Computer Science, Software Engineering, or equivalent;
24、Relevant certifications such as Certified Secure Software Lifecycle Professional (CSSLP), Project Management Professional (PMP), or ITIL are desirable;
25、Hands-on experience in Java/J2EE application development, Spring Framework, and Apache Tomcat is strongly preferred, even if the current role is primarily oversight;
26、Prior experience on delivering Java applications on Google Cloud Platform(GCP) is a significant advantage.