Staff Application Security Engineer

Reltio, an SAP Company, provides a cloud-native Context Intelligence Platform that connects and governs enterprise data for AI and business applications. The Staff Application Security Engineer will define and drive application and product security architecture, secure SDLC strategy, shift-left automation, and security for API-driven and AI technologies. The role also leads threat modeling, vulnerability management, penetration testing, security architecture reviews, and cross-functional security initiatives.

Responsibilities:

• Serve as the senior application security subject matter expert, providing guidance on industry best practices, secure design patterns, and defense-in-depth strategies for the product security architecture
• Helps to define and drive the overall application/product security architecture, vision, strategy, and roadmap across Reltio’s platform and services
• Influence engineering architecture and roadmap decisions without direct authority, driving risk-based consensus across teams
• Mentor and uplevel application security engineers and development teams, raising the secure-coding maturity of the broader organization
• Embed security throughout the SDLC, from design through deployment, and define secure coding standards and best practices adopted across teams
• Drive shift-left initiatives by providing guidance, tooling, paved-road patterns, and remediation support that enable engineers to build securely from the outset
• Design and implement security controls within CI/CD pipelines, enabling automated security testing and vulnerability detection at scale
• Operationalize SAST, SCA, DAST, and secrets scanning as policy-driven, low-friction gates; partner with release management on secure deployment checks and policy compliance
• Lead threat modeling sessions for complex, high-impact systems to identify and mitigate security risks early in design and architecture phases
• Perform technical risk assessments of new technology and ensure solutions meet secure architecture designs; assess, measure, and clearly communicate risk impact to stakeholders
• Analyze and validate remediation of application security findings from SAST, SCA, DAST, API testing, penetration tests, and manual assessments
• Drive risk-based prioritization of fixes, reduce false positives, and provide clear, actionable remediation guidance with proper pre-release validation
• Partner with engineering to ensure secure API design and implementation; identify and mitigate authentication/authorization issues, data exposure, rate-limiting gaps, and OWASP API Top 10 risks
• Helps to define AI security guardrails for Reltio’s AI and multi-agent platforms, addressing prompt/output validation, insecure model usage, data leakage, and tenant-isolation concerns
• Establish security standards for Model Context Protocol (MCP) servers and tools—covering tool authorization, scoping, and abuse prevention—and lead threat modeling of agentic workflows (autonomous tool use, indirect prompt injection, excessive agency)
• Develop new and novel defense techniques to detect and stop advanced application- and AI-layer adversary tactics, and evaluate AI-assisted security tooling to scale detection and remediation
• Perform and oversee application, API, and AI/agent penetration testing; build and curate test payloads (including prompt-injection and guardrail bypass suites) and validate control effectiveness
• Deliver secure-coding, API, and AI-security guidance and hands-on support during code and design reviews
• Partner with DevOps, QA, Engineering, Product, and Release Management to integrate security requirements throughout development and release
• Stay current on emerging application, API, and AI/agentic security threats and continuously improve security processes, tooling, and overall posture
• Investigate security events and incidents leveraging security tooling, and support customer-facing security communications as needed

Requirements:

• 8+ years of experience in application security or software development, including significant time in a cloud-native or SaaS environment
• Demonstrated technical leadership as a senior individual contributor: setting standards, driving cross-team initiatives, and influencing architecture without direct authority
• Hands-on experience with secure coding practices and modern application development; proficiency leading secure code reviews
• Strong understanding of cloud well-architected frameworks, application development, and deployment workflows
• Strong understanding of application security vulnerabilities (OWASP Top 10) and prevention strategies
• Strong understanding of API security principles and the OWASP API Top 10
• Experience integrating security into CI/CD and release management processes (e.g., Jenkins, ArgoCD, or similar)
• Experience with application security testing methodologies—SAST, SCA, and DAST—integrated into CI/CD pipelines
• Experience with AI security concepts, including guardrails, prompt and output validation, data protection, and MCP security
• Hands-on experience with web technologies such as Java, Java Spring Boot, JavaScript, Node.js, C#, modern UI frameworks, microservices, and cloud-native/serverless architectures
• Experience with AWS, GCP, and/or Azure, and securing containerized environments and Kubernetes
• Hands-on experience with Burp Suite Pro for web and API testing
• Experience with modern application security platforms, with Wiz preferred (other AppSec tools acceptable)
• Strong communication and presentation skills, with the ability to educate, collaborate, and drive risk-based consensus
• Self-starter with a history of driving technical initiatives; adaptable, agile, and effective in global, distributed teams
• Hands-on experience securing LLM applications and multi-agent systems, including agentic guardrail frameworks (e.g., NeMo Guardrails, AWS Bedrock Guardrails) and MCP gateway/tool security
• Experience building or operationalizing AppSec automation/orchestration (SAST/SCA/secrets + AI analysis) and defect-management integration (e.g., DefectDojo)
• Experience with commercial AppSec/SCA platforms such as Wiz Code, Veracode, Checkmarx, Cycode, or SonarQube
• Experience developing and operationalizing a vulnerability management or product security program at scale
• Experience with industry frameworks such as SOC 2, HITRUST, or ISO 27001, and supporting audit/customer-assurance processes
• Applying ML/AI techniques to enhance security detection, anomaly identification, and automated risk prioritization
• Relevant security and cloud certifications