API Security Engineer

What you'll do

• Implement and tune runtime controls such as behavioral detection, bot defense, and rate limiting across API gateways and service meshes.
• Provide secure design guidance to engineering teams regarding authentication, authorization, input validation, and OWASP API Security standards.
• Build automation for the CI/CD pipeline including policy-as-code, automated security checks, and secret scanning.
• Develop dashboards and analytics using API telemetry to measure risk, control effectiveness, and program outcomes.
• Establish governance for API inventories, ownership, classification, and consistent security requirements across the organization.
• Integrate security requirements into the DevSecOps lifecycle through threat modeling, design reviews, and incident response planning.
• Map security controls to industry frameworks like NIST, ISO 27001, and PCI DSS to ensure audit readiness.
• Evaluate and pilot emerging technologies for API discovery, posture management, and runtime detection.

What we're looking for

• You must possess valid and unrestricted U.S. work authorization.
• A bachelor's degree or an MS is preferred.
• CISSP or other professional cyber certifications are desirable.
• 5+ years of related IT and cyber protection experience is desired.
• You must have a strong foundation in API security concepts including OAuth2, OIDC, JWT, and rate limiting.
• You must have practical experience with runtime protections such as API gateways, WAF/WAAP, or service mesh.
• You must be able to build automation in CI/CD and cloud-native environments using policy-as-code and scripting.
• You should have expert knowledge of cyber technologies like Traceable, Salt Security, or NoName.