Lead AI Security & DevSecOps

What You Will Do

Application & Code Security Governance

• Own and enforce secure development standards for all internally built applications platforms automation and tooling across a diverse stack including Java React Python (Django FastAPI) JavaScript HTML and C .
• Perform and oversee manual and automated code reviews (static dynamic dependency and supply chain analysis) tailored to the specific language and framework in use.
• Establish clear release gates requiring security approval before software or AI systems are delivered to customers or promoted internally.
• Define remediation standards and risk acceptance criteria for security findings.
• Conduct secure design reviews and application threat modeling during early development phases to identify and mitigate risk before implementation.

AI & Emerging Technology Security

• Review internally developed AI models agents prompts integrations and data pipelines for security privacy and misuse risk.
• Perform AI-based security analysis on code and integrated AI components specifically identifying and mitigating Prompt Injection vulnerabilities and AI-based data leakage risks within application code and model interactions.
• Evaluate AI integrations for exposure of sensitive data through model outputs embeddings or training pipelines and enforce controls to prevent unauthorized data exfiltration via AI features.
• Ensure AI systems comply with internal governance customer contractual obligations and emerging regulatory expectations.
• Partner with engineering and data teams to implement secure AI development patterns including data protection access controls and auditability.

DevSecOps Enablement

• Integrate security tooling into CI/CD pipelines specifically Jenkins and GitHub Enterprise including SAST DAST dependency scanning container scanning and secrets detection.
• Promote shift left security practices and reduce late stage security blockers through developer enablement.
• Collaborate with DevOps and Platform teams on secure delivery pipelines and runtime controls.
• Secure data persistence and messaging layers including RabbitMQ Kafka Cassandra MongoDB and Snowflake ensuring encryption access control and secure configuration.

Risk Compliance & IP Protection

• Protect XTIUMs intellectual property by ensuring secure design code custody and controlled access to source repositories within GitHub Enterprise.
• Support compliance efforts across frameworks such as SOC 2 ISO 27001 and customer specific security requirements.
• Produce audit ready artifacts including risk assessments code review records and security sign offs.

Leadership & Collaboration

• Act as the primary application security escalation point for engineering and leadership.
• Mentor developers and engineers on secure coding practices and threat modeling across multiple languages and frameworks.
• Provide executive level reporting on application and AI security posture trends and risk exposure.

What Qualifies You

• 8 years of experience in application security DevSecOps or secure software development.
• Strong hands on experience reviewing code in one or more modern languages (e.g. Java JavaScript/TypeScript Python C ).
• Proven experience securing APIs web applications microservices and cloud native platforms across Azure and AWS.
• Experience integrating security controls into CI/CD pipelines and modern DevOps workflows specifically with Jenkins and GitHub Enterprise.
• Deep understanding of common vulnerabilities and attack patterns (OWASP Top 10 API security risks supply chain threats).
• Demonstrated experience with AI security analysis including identifying Prompt Injection vectors and detecting AI-based data leakage within code and AI-integrated applications.
• Experience securing data storage and messaging technologies such as RabbitMQ Kafka Cassandra MongoDB and Snowflake.
• Ability to balance security rigor with delivery velocity in a customer facing MSP environment.

Preferred Qualifications:

• Experience securing AI/ML systems automation platforms or data driven applications.
• Familiarity with containerized environments and orchestration.
• Experience in a Managed Services Provider (MSP) or SaaS organization with external customer delivery obligations.
• Knowledge of regulatory and compliance frameworks impacting software and data security.
• Experience with Django and FastAPI frameworks.
• Hands-on experience with AI security tooling red teaming LLMs or implementing guardrails against prompt-based attacks and data exfiltration.

Key Competencies

• Secure Software Architecture
• Application & API Security
• AI Security & Governance
• AI Threat Modeling (Prompt Injection Data Leakage)
• DevSecOps Tooling & Automation
• Cross Functional Leadership

XTIUM is an equal opportunity employer.