Lead Engineer, Information Security; Application Security

Accelerate your career at RXO

RXO is a leading provider of transportation solutions. With cutting-edge technology at the center, we're revolutionizing the industry with our massive network and commitment to finding solutions for every challenge. We create more efficient ways for shippers and carriers to transport goods across North America.

At RXO, we're looking for a Lead Engineer, Application Security to help strengthen and scale our application security program across a multi-cloud environment. In this role, you'll serve as a senior individual contributor responsible for driving secure application architecture, integrating security into the software development lifecycle, and partnering closely with engineering teams to identify and remediate security risks. You'll play a key role in securing modern cloud-native applications, supporting AI initiatives, and advancing our overall security posture.

This position is based out of RXO headquarters located at 11215 N Community House Road, Charlotte, NC 28277 and follows a four-day onsite work schedule Monday through Thursday, with remote work on Fridays.

• Lead the development and governance of application security standards, secure architecture principles, and threat modeling practices across the enterprise.
• Conduct security assessments and threat modeling for emerging technologies, including Agentic AI solutions, Large Language Models (LLMs), and autonomous AI workflows.
• Analyze and tune Web Application Firewall (WAF) configurations, including reviewing F5 and Akamai logs, investigating anomalies, and implementing approved rule exceptions.
• Integrate and optimize automated security tools, including SAST, DAST, and Software Composition Analysis (SCA), within CI/CD pipelines and Dev Sec Ops  processes.
• Partner with software engineering teams to identify vulnerabilities and provide code-level remediation guidance aligned with secure coding best practices.
• Lead and support security awareness initiatives, including mentoring developers and facilitating Security Champion programs across engineering teams.
• Perform application security reviews and contribute to risk identification, vulnerability management, remediation tracking, and reporting efforts.
• Evaluate cloud-native applications and services across Azure, Google Cloud Platform (GCP), and Oracle Cloud Infrastructure (OCI) environments to ensure adherence to security standards.
• Support the implementation of security controls within development pipelines, including mechanisms to prevent deployments with unresolved critical or high-risk vulnerabilities.
• Drive continuous improvement initiatives to enhance application security processes, tooling, and developer enablement.

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, Engineering, or a related field, or equivalent combination of education and experience.
• 3+ years of experience in Application Security, Security Engineering, Dev Sec Ops , or a related cybersecurity discipline.
• Experience identifying and remediating security vulnerabilities within application code and software development environments.
• Experience working with enterprise WAF platforms such as Akamai App & API Protector, F5 Advanced WAF, or similar technologies.
• Experience securing cloud-native workloads and applications within Azure, GCP, and/or OCI environments.
• Experience with container technologies, including Docker and Kubernetes.
• Experience integrating security tools into CI/CD pipelines and development workflows.
• Knowledge of OWASP Top 10, Common Weakness Enumeration (CWE), secure API design principles, and application security best practices.
• Strong analytical, problem-solving, and communication skills with the ability to collaborate across technical teams.

• Experience securing AI-enabled applications, LLM-based solutions, or autonomous agent workflows.
• Experience reviewing and securing Infrastructure as Code (IaC) technologies such as Terraform, Ansible, or Bicep.
• Microsoft Certified:
  Azure Security Engineer Associate, GCP Professional Cloud Security Engineer, CISSP, CSSLP, CASE, GWEB, or related security certifications.
• Experience with Akamai and/or F5 security platforms in large-scale enterprise environments.
• Experience leading Security Champion programs or mentoring engineering teams on secure development practices.
• Ability to influence cross-functional teams and drive security improvements through…