Lead Engineer, Information Security (Application Security)

At RXO, we're looking for a Lead Engineer, Application Security to help strengthen and scale our application security program across a multi-cloud environment. In this role, you'll serve as a senior individual contributor responsible for driving secure application architecture, integrating security into the software development lifecycle, and partnering closely with engineering teams to identify and remediate security risks. You'll play a key role in securing modern cloud-native applications, supporting AI initiatives, and advancing our overall security posture.

This position is based out of RXO headquarters located at 11215 N Community House Road, Charlotte, NC 28277 and follows a four-day onsite work schedule Monday through Thursday, with remote work on Fridays.

What your day-to-day will look like:

• Lead the development and governance of application security standards, secure architecture principles, and threat modeling practices across the enterprise.

• Conduct security assessments and threat modeling for emerging technologies, including Agentic AI solutions, Large Language Models (LLMs), and autonomous AI workflows.

• Analyze and tune Web Application Firewall (WAF) configurations, including reviewing F5 and Akamai logs, investigating anomalies, and implementing approved rule exceptions.

• Integrate and optimize automated security tools, including SAST, DAST, and Software Composition Analysis (SCA), within CI/CD pipelines and DevSecOps processes.

• Partner with software engineering teams to identify vulnerabilities and provide code-level remediation guidance aligned with secure coding best practices.

• Lead and support security awareness initiatives, including mentoring developers and facilitating Security Champion programs across engineering teams.

• Perform application security reviews and contribute to risk identification, vulnerability management, remediation tracking, and reporting efforts.

• Evaluate cloud-native applications and services across Azure, Google Cloud Platform (GCP), and Oracle Cloud Infrastructure (OCI) environments to ensure adherence to security standards.

• Support the implementation of security controls within development pipelines, including mechanisms to prevent deployments with unresolved critical or high-risk vulnerabilities.

• Drive continuous improvement initiatives to enhance application security processes, tooling, and developer enablement.
  

At a minimum, you'll need:

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, Engineering, or a related field, or equivalent combination of education and experience.

• 3+ years of experience in Application Security, Security Engineering, DevSecOps, or a related cybersecurity discipline.

• Experience identifying and remediating security vulnerabilities within application code and software development environments.

• Experience working with enterprise WAF platforms such as Akamai App & API Protector, F5 Advanced WAF, or similar technologies.

• Experience securing cloud-native workloads and applications within Azure, GCP, and/or OCI environments.

• Experience with container technologies, including Docker and Kubernetes.

• Experience integrating security tools into CI/CD pipelines and development workflows.

• Knowledge of OWASP Top 10, Common Weakness Enumeration (CWE), secure API design principles, and application security best practices.

• Strong analytical, problem-solving, and communication skills with the ability to collaborate across technical teams.
  

It'd be great if you also have:

• Experience securing AI-enabled applications, LLM-based solutions, or autonomous agent workflows.

• Experience reviewing and securing Infrastructure as Code (IaC) technologies such as Terraform, Ansible, or Bicep.

• Microsoft Certified: Azure Security Engineer Associate, GCP Professional Cloud Security Engineer, CISSP, CSSLP, CASE, GWEB, or related security certifications.

• Experience with Akamai and/or F5 security platforms in large-scale enterprise environments.

• Experience leading Security Champion programs or mentoring engineering teams on secure development practices.

• Ability to influence cross-functional teams and drive security improvements through collaboration and technical expertise.

• Experience developing scalable security frameworks that support innovation while managing enterprise risk.