- Contractor Squad Pairing & PR Review

The Vice President (VP) / Senior Software Engineer – Technical Remediation & Enablement Lead is a hands-on, code-level technical specialist responsible for driving the direct remediation of software vulnerabilities across enterprise application teams. This individual contributor / team-level technical lead works alongside application developers and contractor engineers to fix static code vulnerabilities (SAST), patch vulnerable software dependencies (SCA/third-party libraries), containerize workloads, and streamline local build/release pipelines to achieve same-day vulnerability hotfix and deployment capabilities.

This role combines active software engineering (writing/refactoring code and debugging pipelines) with technical enablement, guiding squad developers on how to adopt internal security and build tools, resolve tricky dependency conflicts, and package applications into up-to-date containers for rapid, low-risk production releases.

Key Responsibilities & Core Duties

- Hands-On Code Remediation & Dependency Patching
- Write, refactor, and review application code to directly remediate static code analysis (SAST) findings (e.g., SQL/command injection, cross-site scripting, insecure deserialization, improper error handling, weak cryptography).
- Resolve complex third-party library and framework upgrades (SCA/CVE remediation), managing transitive dependency conflicts, breaking API changes, and version incompatibilities across Java, Python, Go, .NET, or JavaScript/TypeScript stacks.
- Implement targeted automated unit, integration, and regression tests to validate that code fixes and patched libraries do not introduce functional regressions.
- Containerization & Same-Day Release Enablement




- Work directly in application repositories to write and optimize Dockerfiles, container manifests, and base image configurations (Docker, OCI, Kubernetes/OpenShift).
- Assist application squads in containerizing non-containerized legacy services, establishing minimal base images and automated base-image rebuild triggers for same-day OS/runtime patching.
- Help configure and fine-tune CI/CD build scripts and release pipelines to compress deployment cycle times and eliminate manual deployment steps for emergency hotfixes.
- Application Plan Technical Validation
- Perform code-level reviews of proposed remediation plans from application teams, verifying whether proposed library version bumps or refactored logic effectively eliminate the root cause of the vulnerability.
- Identify technical prerequisites (e.g., test coverage gaps, build tool upgrades, compiler/runtime updates) needed before a team can successfully patch and release.
- Contractor Squad Pairing & PR Review
- Act as a peer reviewer and technical guide for external contractor engineers assigned to assist with remediation work.
- Review contractor-submitted pull requests (PRs) for code cleanliness, security correctness, test coverage, and enterprise architectural standards.
- Facilitate smooth technical onboarding and repository access for contractor developers.




- Internal Tooling Adoption & Developer Feedback
- Actively pilot, adopt, and demonstrate internal developer tools, IDE security plugins, automated PR bots (e.g., Dependabot/Renovate patterns), and local scanning utilities within engineering squads.
- Troubleshoot false positives, scanner configuration errors, and build pipeline failures; provide direct, actionable feedback to internal platform and tooling teams to improve developer experience.

Required Qualifications & Experience

Education & Experience Requirements

- Bachelor’s Degree in Computer Science, Software Engineering, Information Systems, or related technical field.
- 4–7 years of hands-on software development and engineering experience delivering enterprise web applications, microservices, or distributed backend systems.
- Proven track record of directly fixing static code vulnerabilities (SAST) and managing third-party dependency/package upgrades in production environments.
- Practical, hands-on experience containerizing applications and working with container orchestration platforms (Docker, Kubernetes, OpenShift).

Technical Proficiencies

- Core Programming Languages: Strong, hands-on development proficiency in at least one or two primary enterprise languages: Java (Spring Boot), Python, Go, C#/.NET, or TypeScript/Node.js.
- Static Code Analysis (SAST): Ability to analyze and fix scanner findings from tools such as SonarQube, Checkmarx, Veracode, or Fortify.
- Dependency & Package Management: Practical experience with dependency resolution and build tools: Maven, Gradle, npm/yarn, NuGet, pip/Poetry, or Go modules, alongside SCA tools like Snyk, Black Duck, or JFrog Xray.

📌 Senior Software Engineer Technical Remediation (Mississauga)
🏢 Citi
📍 Mississauga