Staff Application Security Engineer
United States · USD 145,000-207,000 · 8+ years experience · Posted Oct 19, 2026
At a glance
- Experience
- 8+ years experience
- Location
- United States
- Salary
- USD 145,000-207,000
About the role
- As a senior individual contributor on the Application Security team, the Staff Application Security Engineer will help to define and drive Reltio’s application and product security architecture across a distributed, cloud-native SaaS platform.
- This role helps in the technical direction for securing how Reltio designs, builds, and ships software—helps to define the strategy and roadmap for secure SDLC, shift-left automation, and the secure adoption of API-driven and AI/agentic technologies.
Responsibilities
- Serve as the senior application security subject matter expert, providing guidance on industry best practices, secure design patterns, and defense-in-depth strategies for the product security architecture.
- Helps to define and drive the overall application/product security architecture, vision, strategy, and roadmap across Reltio’s platform and services.
- Influence engineering architecture and roadmap decisions without direct authority, driving risk-based consensus across teams.
- Mentor and uplevel application security engineers and development teams, raising the secure-coding maturity of the broader organization.
- Embed security throughout the SDLC, from design through deployment, and define secure coding standards and best practices adopted across teams.
- Drive shift-left initiatives by providing guidance, tooling, paved-road patterns, and remediation support that enable engineers to build securely from the outset.
- Design and implement security controls within CI/CD pipelines, enabling automated security testing and vulnerability detection at scale.
- Lead threat modeling sessions for complex, high-impact systems to identify and mitigate security risks early in design and architecture phases.
- Analyze and validate remediation of application security findings from SAST, SCA, DAST, API testing, penetration tests, and manual assessments.
- Helps to define AI security guardrails for Reltio’s AI and multi-agent platforms, addressing prompt/output validation, insecure model usage, data leakage, and tenant-isolation concerns.
Requirements
- 8+ years of experience in application security or software development, including significant time in a cloud-native or SaaS environment.
- Demonstrated technical leadership as a senior individual contributor: setting standards, driving cross-team initiatives, and influencing architecture without direct authority.
- Hands-on experience with secure coding practices and modern application development; proficiency leading secure code reviews.
- Strong understanding of cloud well-architected frameworks, application development, and deployment workflows.
- Strong understanding of application security vulnerabilities (OWASP Top 10) and prevention strategies.
- Strong understanding of API security principles and the OWASP API Top 10.
- Experience integrating security into CI/CD and release management processes (e.g., Jenkins, ArgoCD, or similar).
- Experience with application security testing methodologies—SAST, SCA, and DAST—integrated into CI/CD pipelines.
- Experience with AI security concepts, including guardrails, prompt and output validation, data protection, and MCP security.
- Strong communication and presentation skills, with the ability to educate, collaborate, and drive risk-based consensus.
Preferred qualifications
- Hands-on experience securing LLM applications and multi-agent systems, including agentic guardrail frameworks (e.g., NeMo Guardrails, AWS Bedrock Guardrails) and MCP gateway/tool security.
- Experience building or operationalizing AppSec automation/orchestration (SAST/SCA/secrets + AI analysis) and defect-management integration (e.g., DefectDojo).
- Experience with commercial AppSec/SCA platforms such as Wiz Code, Veracode, Checkmarx, Cycode, or SonarQube.
- Experience developing and operationalizing a vulnerability management or product security program at scale.
- Experience with industry frameworks such as SOC 2, HITRUST, or ISO 27001, and supporting audit/customer-assurance processes.
- Applying ML/AI techniques to enhance security detection, anomaly identification, and automated risk prioritization.
- Relevant security and cloud certifications.
Workplace
- Founded on a distributed workforce
Skills
- Java
- Java Spring Boot
- JavaScript
- Node.js
- C#
- Jenkins
- ArgoCD
- AWS
- GCP
- Azure
- Kubernetes
- Burp Suite Pro
Show all 15 skills
- Wiz
- NeMo Guardrails
- AWS Bedrock Guardrails
