Software Engineer 2

Black Duck Software, Inc. helps organizations build secure, high-quality software, minimizing risks while maximizing speed and productivity. Black Duck, a recognized pioneer in application security, provides SAST, SCA, and DAST solutions that enable teams to quickly find and fix vulnerabilities and defects in proprietary code, open source components, and application behavior. With a combination of industry-leading tools, services, and expertise, only Black Duck helps organizations maximize security and quality in DevSecOps and throughout the software development life cycle.

Requirements

- 3+ years of professional Python development experience - Strong understanding of Python internals (AST module, import system, metaclasses, descriptors) - Experience with at least two of: Django, Flask, FastAPI - Familiarity with common web security vulnerabilities (OWASP Top 10: SQLi, XSS, command injection, etc.) - Experience writing and maintaining unit/integration tests with pytest - Comfortable with Docker-based development and testing workflows - Understanding of async Python (asyncio, context variables)

Nice to Have

- Experience with bytecode/AST transformation or monkey patching (e.g., wrapt) - Knowledge of data flow analysis or taint tracking techniques - Experience supporting multiple Python versions (3.8-3.14) - Familiarity with WebSocket protocols and real-time communication - Experience with zero-dependency library design (vendoring approach) - AWS Lambda or Kubernetes experience - Contributions to security tooling or SAST/DAST/IAST products

Responsibilities

- Develop and maintain security checkers that detect vulnerabilities at runtime - Build monkey-patching probes for Python libraries and frameworks - Extend AST transformation logic to track data flow through application code - Ensure compatibility across Python 3.8-3.14 and major web frameworks - Write integration tests against sample applications (Django, Flask, FastAPI) - Debug complex instrumentation issues in customer environments - Maintain zero-runtime-dependency architecture (vendor all third-party code) - Collaborate on architecture decisions for new detection capabilities