Java Security Delivery Analyst

Excelia is a multinational Consulting, Technology, and Professional Services firm with over 25 years of experience. We operate in more than 50 countries across Europe, Latin America, and the United States, participating in high-impact projects and international technological environments.

📢 We are looking for a Java Security Delivery Analyst / Security Transformation Analyst to join our team!

📍 Location: Madrid - Las Tablas
🏠 Hybrid model: 1-2 days on-site per week

🔹 What are we looking for?

We are looking for professionals with a technical background in Java development and Cybersecurity, to participate in Application Security, Security Delivery, and application transformation projects.

The position will have a strong component of security and vulnerability remediation in Java environments, working directly with development teams to identify vulnerabilities, propose solutions, and apply changes to code, libraries, and architectures.

We are looking for both Junior and Senior profiles, adapting the level of responsibility to experience.

🛠️ Main responsibilities

• Analyze and manage security vulnerabilities in Java applications.

• Not limited to identifying vulnerabilities, but proposing and supporting the development team in their remediation.

• Guide developers in the changes necessary to resolve vulnerabilities.

• Propose code modifications, configurations, or specific versions of secure libraries.

• Analyze vulnerabilities related to third-party dependencies and manage their remediation.

• Review results from SCA and SAST tools.

• Analyze code vulnerabilities and determine their impact and solution.

• Participate in the update and modernization of legacy Java architectures.

• Collaborate with development teams to implement Secure Coding principles.

• Review Java code to identify insecure practices and propose alternatives.

• Participate in Application Security and DevSecOps initiatives.

• Contribute to the definition and improvement of secure development processes.

• Provide technical support to teams during the vulnerability remediation process.

💻 Technical knowledge

• Solid experience with Java.

• Spring, Spring Boot, and Spring Security.

• Knowledge of Jakarta EE / J2EE.

• Experience working with Java applications and architectures, including legacy environments.

• Knowledge of Maven and Gradle.

• Management and resolution of transitive dependencies.

• Ability to analyze dependency conflicts and select secure versions.

• Experience in remediation of vulnerabilities associated with third-party libraries.

• Experience with SCA (Software Composition Analysis) tools.

• Knowledge of SAST (Static Application Security Testing).

• Ability to interpret results from security tools and translate them into concrete code solutions.

🔐 Java Vulnerabilities

Practical knowledge of identification, exploitation, and mitigation of common vulnerabilities in Java applications, including:

• Insecure deserialization.

• SQL/HQL injections.

• Vulnerabilities related to JNDI.

• XXE (XML External Entity) and insecure XML configurations.

• Bypass and authentication/authorization issues in Spring.

• Vulnerabilities associated with third-party dependencies such as Log4j, Jackson, and other common libraries in the Java ecosystem.

🛡️ Secure Development

• Ability to refactor insecure code.

• Implementation of input validations.

• Sanitization and secure data management.

• Application of Secure Coding principles.

• Proper use of cryptographic mechanisms in Java.

• Knowledge of JCA/JCE (Java Cryptography Architecture / Java Cryptography Extension).

• Application of security best practices during the development cycle.

• Between 1 and 3 years of experience as a Java developer or security analyst.

• Significant experience or exposure to projects based on Java/Spring.

• Knowledge of Maven or Gradle.

• Basic knowledge of application security and common vulnerabilities in Java.

• Interest in developing in Application Security / DevSecOps.

• Ability to work with development teams and support them in resolving vulnerabilities.

• Minimum 2-3 years combining advanced Java development and Cybersecurity.

• Demonstrable experience in remediation of complex vulnerabilities.

• Experience working with SCA, SAST, and Application Security.

• Experience updating or modernizing legacy Java architectures.

• Ability to technically lead remediation processes and support development teams.

• Experience with specific vulnerabilities of the Java and Spring ecosystem.

🤝 Soft Skills

• Ability to communicate fluently with development teams.

• Skill to explain technical vulnerabilities and propose practical solutions.

• Problem-solving orientation.

• Ability to translate security risks into concrete code or architecture changes.

• Collaborative work with Security, Development, and Operations teams.

• Orientation toward continuous improvement and secure development.