Staff Application Security Engineer

Reltio

6d•$145,000 - $207,000

About The Position

As a senior individual contributor on Reltio’s Application Security team, the Staff Application Security Engineer helps define and drive application and product security architecture across a distributed, cloud-native SaaS platform. The role provides technical direction for securing how Reltio designs, builds, and ships software, including the strategy and roadmap for the secure software development lifecycle, shift-left automation, and secure adoption of API-driven and AI/agentic technologies. The engineer partners with Engineering, DevOps, Product, and Release Management to embed security into software design and delivery. The role sets standards, mentors and develops security and engineering staff, leads complex threat modeling and architecture reviews, and develops techniques to identify and stop application- and AI-layer attacks, protecting Reltio’s intellectual property and customer data globally.

Requirements

At least 8 years of experience in application security or software development, including significant experience in a cloud-native or SaaS environment.
Demonstrated technical leadership as a senior individual contributor, including setting standards, driving cross-team initiatives, and influencing architecture without direct authority.
Hands-on experience with secure coding practices and modern application development, including proficiency leading secure code reviews.
Strong understanding of cloud well-architected frameworks, application development, and deployment workflows.
Strong understanding of OWASP Top 10 application security vulnerabilities and prevention strategies.
Strong understanding of API security principles and the OWASP API Top 10.
Experience integrating security into CI/CD and release management processes, using Jenkins, ArgoCD, or similar tools.
Experience with SAST, SCA, and DAST methodologies integrated into CI/CD pipelines.
Experience with AI security concepts, including guardrails, prompt and output validation, data protection, and MCP security.
Hands-on experience with web technologies including Java, Java Spring Boot, JavaScript, Node.js, C#, modern UI frameworks, microservices, and cloud-native or serverless architectures.
Experience with AWS, GCP, and/or Azure, and securing containerized environments and Kubernetes.
Hands-on experience with Burp Suite Pro for web and API testing.
Experience with modern application security platforms; Wiz is preferred, though other AppSec tools are acceptable.
Strong communication and presentation skills, including the ability to educate, collaborate, and drive risk-based consensus.
Self-starter with a history of driving technical initiatives; adaptable, agile, and effective in global, distributed teams.

Nice To Haves

Hands-on experience securing LLM applications and multi-agent systems, including agentic guardrail frameworks such as NeMo Guardrails or AWS Bedrock Guardrails, and MCP gateway/tool security.
Experience building or operationalizing AppSec automation and orchestration, including SAST, SCA, secrets scanning, AI analysis, and defect-management integration such as DefectDojo.
Experience with commercial AppSec/SCA platforms such as Wiz Code, Veracode, Checkmarx, Cycode, or SonarQube.
Experience developing and operationalizing a vulnerability management or product security program at scale.
Experience with frameworks such as SOC 2, HITRUST, or ISO 27001 and supporting audit or customer-assurance processes.
Experience applying ML/AI techniques to enhance security detection, anomaly identification, and automated risk prioritization.
Relevant security and cloud certifications.

Responsibilities

Provide senior application security expertise, guidance on industry best practices, secure design patterns, and defense-in-depth strategies.
Help define and drive application and product security architecture, vision, strategy, and roadmap across Reltio’s platform and services.
Influence engineering architecture and roadmap decisions and build risk-based consensus across teams.
Mentor and develop application security engineers and development teams, improving secure-coding maturity.
Embed security throughout the SDLC and define secure-coding standards and practices.
Drive shift-left initiatives through guidance, tooling, paved-road patterns, and remediation support.
Design and implement security controls in CI/CD pipelines and operationalize SAST, SCA, DAST, and secrets scanning as policy-driven gates.
Partner with Release Management on secure deployment checks and policy compliance.
Lead threat modeling for complex, high-impact systems and perform technical risk assessments of new technology and solutions.
Assess and communicate risk impact to stakeholders.
Analyze application security findings and validate remediation from SAST, SCA, DAST, API testing, penetration tests, and manual assessments.
Prioritize fixes based on risk, reduce false positives, and provide actionable remediation guidance with pre-release validation.
Partner with engineering on secure API design and implementation, addressing authentication and authorization issues, data exposure, rate-limiting gaps, and OWASP API Top 10 risks.
Help define AI security guardrails for AI and multi-agent platforms, including prompt and output validation, model usage, data leakage, and tenant isolation.
Establish security standards for MCP servers and tools, including authorization, scoping, and abuse prevention, and lead threat modeling of agentic workflows.
Develop defenses against application- and AI-layer adversary tactics and evaluate AI-assisted security tooling.
Perform and oversee application, API, and AI/agent penetration testing; build test payloads and validate control effectiveness.
Deliver secure-coding, API, and AI-security guidance and hands-on support during code and design reviews.
Collaborate with DevOps, QA, Engineering, Product, and Release Management to integrate security requirements throughout development and release.
Track emerging application, API, and AI/agentic security threats and improve security processes, tooling, and posture.
Investigate security events and incidents using security tooling and support customer-facing security communications as needed.