SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Salary: USD 145,000 - 207,000 / annual
Reltio, an SAP Company, is seeking a Staff Application Security Engineer to serve as a senior individual contributor and subject matter expert on the Application Security team. You will help define and drive Reltio's application and product security architecture across a distributed, cloud-native SaaS platform, with a focus on securing how the company designs, builds, and ships software—including strategy and roadmap for secure SDLC, shift-left automation, and secure adoption of API-driven and AI/agentic technologies.
You will partner with Engineering, DevOps, Product, and Release Management teams to embed security as a foundational part of software design and delivery. Key responsibilities include:
**Security Architecture & Technical Leadership**: Serve as the senior application security subject matter expert, providing guidance on industry best practices and secure design patterns. Define and drive the overall application/product security architecture, vision, strategy, and roadmap. Influence engineering architecture decisions without direct authority, driving risk-based consensus. Mentor and uplevel application security engineers and development teams.
**Secure Development Lifecycle & Shift-Left**: Embed security throughout the SDLC from design through deployment. Define secure coding standards and best practices. Drive shift-left initiatives by providing guidance, tooling, and remediation support.
**CI/CD Pipeline Security**: Design and implement security controls within CI/CD pipelines. Operationalize SAST, SCA, DAST, and secrets scanning as policy-driven gates.
**Threat Modeling & Risk Assessment**: Lead threat modeling sessions for complex, high-impact systems. Perform technical risk assessments of new technology and communicate risk impact to stakeholders.
**Vulnerability Management**: Analyze and validate remediation of application security findings. Drive risk-based prioritization and provide actionable remediation guidance.
**API Security**: Partner with engineering to ensure secure API design and implementation. Identify and mitigate authentication/authorization issues and OWASP API Top 10 risks.
**AI & Agentic Security**: Define AI security guardrails for Reltio's AI and multi-agent platforms. Establish security standards for Model Context Protocol (MCP) servers. Develop novel defense techniques to detect and stop advanced application- and AI-layer adversary tactics.
**Penetration Testing & Security Validation**: Perform and oversee application, API, and AI/agent penetration testing. Build and curate test payloads including prompt-injection and guardrail bypass suites.
**Training, Collaboration & Continuous Improvement**: Deliver secure-coding, API, and AI-security guidance during code and design reviews. Partner across teams to integrate security requirements. Stay current on emerging threats and continuously improve security processes.
**Requirements:**
- 8+ years of experience in application security or software development, including significant time in a cloud-native or SaaS environment
- Demonstrated technical leadership as a senior individual contributor: setting standards, driving cross-team initiatives, and influencing architecture without direct authority
- Hands-on experience with secure coding practices and modern application development; proficiency leading secure code reviews
- Strong understanding of cloud well-architected frameworks, application development, and deployment workflows
- Strong understanding of application security vulnerabilities (OWASP Top 10) and prevention strategies
- Strong understanding of API security principles and the OWASP API Top 10
- Experience integrating security into CI/CD and release management processes (e.g., Jenkins, ArgoCD, or similar)
- Experience with application security testing methodologies—SAST, SCA, and DAST—integrated into CI/CD pipelines
- Experience with AI security concepts, including guardrails, prompt and output validation, data protection, and MCP security
- Hands-on experience with web technologies such as Java, Java Spring Boot, JavaScript, Node.js, C#, modern UI frameworks, microservices, and cloud-native/serverless architectures
- Experience with AWS, GCP, and/or Azure, and securing containerized environments and Kubernetes
- Hands-on experience with Burp Suite Pro for web and API testing
- Experience with modern application security platforms, with Wiz preferred (other AppSec tools acceptable)
- Strong communication and presentation skills, with the ability to educate, collaborate, and drive risk-based consensus
- Self-starter with a history of driving technical initiatives; adaptable, agile, and effective in global, distributed teams
**Nice to Have:**
- Hands-on experience securing LLM applications and multi-agent systems, including agentic guardrail frameworks (e.g., NeMo Guardrails, AWS Bedrock Guardrails) and MCP gateway/tool security
- Experience building or operationalizing AppSec automation/orchestration (SAST/SCA/secrets + AI analysis) and defect-management integration (e.g., DefectDojo)
- Experience with commercial AppSec/SCA platforms such as Wiz Code, Veracode, Checkmarx, Cycode, or SonarQube
- Experience developing and operationalizing a vulnerability management or product security program at scale
- Experience with industry frameworks such as SOC 2, HITRUST, or ISO 27001, and supporting audit/customer-assurance processes
- Applying ML/AI techniques to enhance security detection, anomaly identification, and automated risk prioritization
- Relevant security and cloud certifications
