What You Will Do
Application & Code Security Governance
Own and enforce secure development standards for all internally built applications, platforms, automation, and tooling across a diverse stack including Java, React, Node.js, Python (Django, FastAPI), JavaScript, HTML, and C++ .
Perform and oversee manual and automated code reviews (static, dynamic, dependency, and supply chain analysis) tailored to the specific language and framework in use.
Establish clear release gates requiring security approval before software or AI systems are delivered to customers or promoted internally.
Define remediation standards and risk acceptance criteria for security findings.
Conduct secure design reviews and application threat modeling during early development phases to identify and mitigate risk before implementation.
AI & Emerging Technology Security
Review internally developed AI models, agents, prompts, integrations, and data pipelines for security, privacy, and misuse risk.
Perform AI-based security analysis on code and integrated AI components, specifically identifying and mitigating Prompt Injection vulnerabilities and AI-based data leakage risks within application code and model interactions.
Evaluate AI integrations for exposure of sensitive data through model outputs, embeddings, or training pipelines, and enforce controls to prevent unauthorized data exfiltration via AI features.
Ensure AI systems comply with internal governance, customer contractual obligations, and emerging regulatory expectations.
Partner with engineering and data teams to implement secure AI development patterns, including data protection, access controls, and auditability.
DevSecOps Enablement
Integrate security tooling into CI/CD pipelines, specifically Jenkins and GitHub Enterprise, including SAST, DAST, dependency scanning, container scanning, and secrets detection.
Promote “shift left” security practices and reduce late stage security blockers through developer enablement.
Collaborate with DevOps and Platform teams on secure delivery pipelines and runtime controls.
Secure data persistence and messaging layers, including RabbitMQ, Kafka, Cassandra, MongoDB, and Snowflake, ensuring encryption, access control, and secure configuration.
Risk, Compliance & IP Protection
Protect XTIUM’s intellectual property by ensuring secure design, code custody, and controlled access to source repositories within GitHub Enterprise.
Support compliance efforts across frameworks such as SOC 2, ISO 27001, and customer specific security requirements.
Produce audit ready artifacts including risk assessments, code review records, and security sign offs.
Leadership & Collaboration
Act as the primary application security escalation point for engineering and leadership.
Mentor developers and engineers on secure coding practices and threat modeling across multiple languages and frameworks.
Provide executive level reporting on application and AI security posture, trends, and risk exposure.
What Qualifies You
Required Qualifications
8+ years of experience in application security, DevSecOps, or secure software development.
Strong hands on experience reviewing code in one or more modern languages (e.g., Java, JavaScript/TypeScript, Python, C++ ).
Proven experience securing APIs, web applications, microservices, and cloud native platforms across Azure and AWS.
Experience integrating security controls into CI/CD pipelines and modern DevOps workflows, specifically with Jenkins and GitHub Enterprise.
Deep understanding of common vulnerabilities and attack patterns (OWASP Top 10, API security risks, supply chain threats).
Demonstrated experience with AI security analysis, including identifying Prompt Injection vectors and detecting AI-based data leakage within code and AI-integrated applications.
Experience securing data storage and messaging technologies such as RabbitMQ, Kafka, Cassandra, MongoDB, and Snowflake.
Ability to balance security rigor with delivery velocity in a customer facing MSP environment.
Preferred Qualifications
Experience securing AI/ML systems, automation platforms, or data driven applications.
Familiarity with containerized environments and orchestration.
Experience in a Managed Services Provider (MSP) or SaaS organization with external customer delivery obligations.
Knowledge of regulatory and compliance frameworks impacting software and data security.
Experience with Django and FastAPI frameworks.
Hands-on experience with AI security tooling, red teaming LLMs, or implementing guardrails against prompt-based attacks and data exfiltration.
Key Competencies
Secure Software Architecture
Application & API Security
AI Security & Governance
AI Threat Modeling (Prompt Injection, Data Leakage)
DevSecOps Tooling & Automation
Risk Based Decision Making
Cross Functional Leadership
Clear Written & Verbal Communication
XTIUM is an equal opportunity employer.
