Security Engineer - Secure Development

The XTIUM global team is composed of diverse and talented professionals united by a commitment to excellence and continuous improvement. We embrace challenges, foster open communication, and collaborate closely. Our culture emphasizes ownership, learning, growth, and accountability to both colleagues and customers. Together, we push boundaries, make meaningful impacts, and inspire one another to achieve our full potential.

Key Responsibilities

Application & Code Security Governance:
- Own and enforce secure development standards for all internally developed applications, platforms, automation, and tooling across a broad technology stack including Java, React, Node.js, Python (Django, FastAPI), JavaScript, HTML, and C++.
- Conduct and oversee manual and automated code reviews, including static, dynamic, dependency, and supply chain analysis tailored to specific languages and frameworks.
- Define and enforce release gates requiring security approval before software or AI systems are delivered to customers or promoted internally.
- Establish remediation standards and risk acceptance criteria for security findings.
- Lead secure design reviews and application threat modeling early in development to proactively identify and mitigate risks.

AI & Emerging Technology Security:
- Review internally developed AI models, agents, prompts, integrations, and data pipelines for security, privacy, and misuse risks.
- Perform AI-specific security analyses, focusing on vulnerabilities such as Prompt Injection and AI-based data leakage within code and model interactions.
- Evaluate AI integrations for potential exposure of sensitive data through model outputs, embeddings, or training pipelines, enforcing controls to prevent unauthorized data exfiltration.
- Ensure AI systems comply with internal governance, customer contractual obligations, and emerging regulatory requirements.
- Collaborate with engineering and data teams to implement secure AI development practices, including data protection, access controls, and auditability.

DevSecOps Enablement:
- Integrate security tooling into CI/CD pipelines, particularly Jenkins and GitHub Enterprise, covering SAST, DAST, dependency scanning, container scanning, and secrets detection.
- Promote “shift left” security practices to minimize late-stage security blockers through developer enablement.
- Work with DevOps and Platform teams to secure delivery pipelines and runtime environments.
- Secure data persistence and messaging layers such as RabbitMQ, Kafka, Cassandra, MongoDB, and Snowflake by enforcing encryption, access control, and secure configurations.

Risk, Compliance & IP Protection:
- Safeguard XTIUM’s intellectual property by ensuring secure design, code custody, and controlled access to source repositories within GitHub Enterprise.
- Support compliance efforts aligned with SOC 2, ISO 27001, and customer-specific security requirements.
- Produce audit-ready documentation including risk assessments, code review records, and security sign-offs.

Leadership & Collaboration:
- Serve as the primary application security escalation point for engineering teams and leadership.
- Mentor developers and engineers on secure coding practices and threat modeling across multiple languages and frameworks.
- Provide executive-level reporting on application and AI security posture, trends, and risk exposure.

Required Qualifications
- Minimum 8 years of experience in application security, DevSecOps, or secure software development.
- Strong hands-on expertise in code review across modern languages such as Java, JavaScript/TypeScript, Python, and C++.
- Proven ability to secure APIs, web applications, microservices, and cloud-native platforms on Azure and AWS.
- Experience integrating security controls into CI/CD pipelines using Jenkins and GitHub Enterprise.
- Deep understanding of common vulnerabilities and attack patterns, including OWASP Top 10, API security risks, and supply chain threats.
- Demonstrated experience in AI security analysis, particularly identifying Prompt Injection vectors and AI-based data leakage risks.
- Familiarity securing data storage and messaging technologies like RabbitMQ, Kafka, Cassandra, MongoDB, and Snowflake.
- Ability to balance rigorous security standards with delivery velocity in a customer-facing Managed Services Provider environment.

Preferred Qualifications
- Experience securing AI/ML systems, automation platforms, or data-driven applications.
- Knowledge of containerized environments and orchestration.
- Background in Managed Services Provider (MSP) or SaaS organizations with external customer delivery responsibilities.
- Understanding of regulatory and compliance frameworks affecting software and data security.
- Hands-on experience with Django and FastAPI frameworks.
- Practical experience with AI security tooling, red teaming large language models, or implementing guardrails against prompt-based attacks and data exfiltration.

XTIUM is an equal opportunity employer committed to fostering an inclusive and diverse workplace.