What You Will Do

Application & Code Security Governance

• Own and enforce secure development standards for all internally built applications, platforms, automation, and tooling across a diverse stack including Java, React, Node.js, Python (Django, FastAPI), JavaScript, HTML, and C++ .
• Perform and oversee manual and automated code reviews (static, dynamic, dependency, and supply chain analysis) tailored to the specific language and framework in use.
• Establish clear release gates requiring security approval before software or AI systems are delivered to customers or promoted internally.
• Define remediation standards and risk acceptance criteria for security findings.
• Conduct secure design reviews and application threat modeling during early development phases to identify and mitigate risk before implementation.

AI & Emerging Technology Security

• Review internally developed AI models, agents, prompts, integrations, and data pipelines for security, privacy, and misuse risk.
• Perform AI-based security analysis on code and integrated AI components, specifically identifying and mitigating Prompt Injection vulnerabilities and AI-based data leakage risks within application code and model interactions.
• Evaluate AI integrations for exposure of sensitive data through model outputs, embeddings, or training pipelines, and enforce controls to prevent unauthorized data exfiltration via AI features.
• Ensure AI systems comply with internal governance, customer contractual obligations, and emerging regulatory expectations.
• Partner with engineering and data teams to implement secure AI development patterns, including data protection, access controls, and auditability.

DevSecOps Enablement

• Integrate security tooling into CI/CD pipelines, specifically Jenkins and GitHub Enterprise, including SAST, DAST, dependency scanning, container scanning, and secrets detection.
• Promote shift left security practices and reduce late stage security blockers through developer enablement.
• Collaborate with DevOps and Platform teams on secure delivery pipelines and runtime controls.
• Secure data persistence and messaging layers, including RabbitMQ, Kafka, Cassandra, MongoDB, and Snowflake, ensuring encryption, access control, and secure configuration.

Risk, Compliance & IP Protection

• Protect XTIUM's intellectual property by ensuring secure design, code custody, and controlled access to source repositories within GitHub Enterprise.
• Support compliance efforts across frameworks such as SOC 2, ISO 27001, and customer specific security requirements.
• Produce audit ready artifacts including risk assessments, code review records, and security sign offs.

Leadership & Collaboration

• Act as the primary application security escalation point for engineering and leadership.
• Mentor developers and engineers on secure coding practices and threat modeling across multiple languages and frameworks.
• Provide executive level reporting on application and AI security posture, trends, and risk exposure.

What Qualifies You

• 8+ years of experience in application security, DevSecOps, or secure software development.
• Strong hands on experience reviewing code in one or more modern languages (e.g., Java, JavaScript/TypeScript, Python, C++ ).
• Proven experience securing APIs, web applications, microservices, and cloud native platforms across Azure and AWS.
• Experience integrating security controls into CI/CD pipelines and modern DevOps workflows, specifically with Jenkins and GitHub Enterprise.
• Deep understanding of common vulnerabilities and attack patterns (OWASP Top 10, API security risks, supply chain threats).
• Demonstrated experience with AI security analysis, including identifying Prompt Injection vectors and detecting AI-based data leakage within code and AI-integrated applications.
• Experience securing data storage and messaging technologies such as RabbitMQ, Kafka, Cassandra, MongoDB, and Snowflake.
• Ability to balance security rigor with delivery velocity in a customer facing MSP environment.

• Experience securing AI/ML systems, automation platforms, or data driven applications.
• Familiarity with containerized environments and orchestration.
• Experience in a Managed Services Provider (MSP) or SaaS organization with external customer delivery obligations.
• Knowledge of regulatory and compliance frameworks impacting software and data security.
• Experience with Django and FastAPI frameworks.
• Hands-on experience with AI security tooling, red teaming LLMs, or implementing guardrails against prompt-based attacks and data exfiltration.

Key Competencies

• Secure Software Architecture
• Application & API Security
• AI Security & Governance
• AI Threat Modeling (Prompt Injection, Data Leakage)
• DevSecOps Tooling & Automation
• Cross Functional Leadership