I recently finished a thesis focused on collecting and organizing
rules for writing secure code in Java. You may find my bibliography
useful in finding books/papers on Java security. You may even consider
reading Chapter 3 of my thesis.

You can find the biblio here (at the bottom of the page):

http://peregrin.jmu.edu/~warems/securejavacode.html

I would start with: [17, 19, 20, 27, 23, 2]

The book by Gong et al. [17] is the best book I've seen on the Java
security architecture. It's very much a technical read.

McGraw and Felton (and the rest of the Princeton gang) [23] were big
players in the early years. Definitely get and read their book to get
caught up.

Hope that helps.