Staff Application Security Engineer

About this role

At Reltio®, an SAP Company, we believe data should fuel your success in the enterprise AI era. Our Context Intelligence Platform turns fragmented data into a trusted, connected context so AI agents and systems can act with expert-level judgement at enterprise scale. Reltio’s cloud-native SaaS platform harmonizes, unifies, and governs data across sources and formats—including unstructured data—in real time, turning them into data assets that can be mobilized in milliseconds to any application, user, or AI agent. Trusted by more than 200 of the world’s largest brands across industries such as life sciences, financial services, healthcare, and technology, we fuel frictionless operations and help enterprises accelerate innovation and reduce risk.

At Reltio, our values guide everything we do. With an unyielding commitment to prioritizing our “Customer First”, we strive to ensure their success. We embrace our differences and are “Better Together” as One Reltio. We are always looking to “Simplify and Share” our knowledge when we collaborate to remove obstacles for each other. We hold ourselves accountable for our actions and outcomes and strive for excellence. We “Own It”. Every day, we innovate and evolve, so that today is “Always Better Than Yesterday”. If you share and embody these values, we invite you to join our team at Reltio and contribute to our mission of excellence.

Reltio has earned numerous awards and industry and analyst recognition for our technology, our culture and our people. Reltio was founded on a distributed workforce and offers flexible work arrangements to help our people manage their personal and professional lives. If you’re ready to work on unrivaled technology where your desire to be part of a collaborative team is met with a laser-focused mission to enable digital transformation with connected data, let’s talk!

Job Summary:

As a senior individual contributor on the Application Security team, the Staff Application Security Engineer will help to define and drive Reltio’s application and product security architecture across a distributed, cloud-native SaaS platform. This role helps in the technical direction for securing how Reltio designs, builds, and ships software—helps to define the strategy and roadmap for secure SDLC, shift-left automation, and the secure adoption of API-driven and AI/agentic technologies.

The Staff Application Security Engineer will partner with the Engineering, DevOps, Product, and Release Management teams to embed security as a foundational part of software design and delivery. The successful candidate will set standards, mentor and uplevel other security and engineering staff, lead complex threat modeling and architecture reviews, and develop novel techniques to identify and stop application- and AI-layer attacks—protecting Reltio’s intellectual property and customer data globally.

Job Duties and Responsibilities:

Security Architecture & Technical Leadership

• Serve as the senior application security subject matter expert, providing guidance on industry best practices, secure design patterns, and defense-in-depth strategies for the product security architecture.

• Helps to define and drive the overall application/product security architecture, vision, strategy, and roadmap across Reltio’s platform and services.

• Influence engineering architecture and roadmap decisions without direct authority, driving risk-based consensus across teams.

• Mentor and uplevel application security engineers and development teams, raising the secure-coding maturity of the broader organization.

Secure Development Lifecycle & Shift-Left

• Embed security throughout the SDLC, from design through deployment, and define secure coding standards and best practices adopted across teams.

• Drive shift-left initiatives by providing guidance, tooling, paved-road patterns, and remediation support that enable engineers to build securely from the outset.

CI/CD Pipeline Security

• Design and implement security controls within CI/CD pipelines, enabling automated security testing and vulnerability detection at scale.

• Operationalize SAST, SCA, DAST, and secrets scanning as policy-driven, low-friction gates; partner with release management on secure deployment checks and policy compliance.

Threat Modeling & Risk Assessment

• Lead threat modeling sessions for complex, high-impact systems to identify and mitigate security risks early in design and architecture phases.

• Perform technical risk assessments of new technology and ensure solutions meet secure architecture designs; assess, measure, and clearly communicate risk impact to stakeholders.

Vulnerability Management

• Analyze and validate remediation of application security findings from SAST, SCA, DAST, API testing, penetration tests, and manual assessments.

• Drive risk-based prioritization of fixes, reduce false positives, and provide clear, actionable remediation guidance with proper pre-release validation.

API Security

• Partner with engineering to ensure secure API design and implementation; identify and mitigate authentication/authorization issues, data exposure, rate-limiting gaps, and OWASP API Top 10 risks.

AI & Agentic Security (Guardrails, MCP, LLM)

• Helps to define AI security guardrails for Reltio’s AI and multi-agent platforms, addressing prompt/output validation, insecure model usage, data leakage, and tenant-isolation concerns.

• Establish security standards for Model Context Protocol (MCP) servers and tools—covering tool authorization, scoping, and abuse prevention—and lead threat modeling of agentic workflows (autonomous tool use, indirect prompt injection, excessive agency).

• Develop new and novel defense techniques to detect and stop advanced application- and AI-layer adversary tactics, and evaluate AI-assisted security tooling to scale detection and remediation.

Penetration Testing & Security Validation

• Perform and oversee application, API, and AI/agent penetration testing;

Similar jobs

• Staff Application Security Engineer — Abridge · Remote
• Staff Application Security Engineer — Thenuclearcompany · Washington, DC
• Staff Application Security Engineer — Ironcladhq · San Francisco
• Staff Application Security Engineer — Datadog · Boston, Massachusetts, USA; New York, New York, USA
• Staff Application Security Engineer — Brex · Remote
• Senior Application Security Engineer — Abridge · Remote
• Senior Application Security Engineer — Tatari · San Francisco, California, United States
• Senior Application Security Engineer — Monarchmoney · Remote