API Security Engineer

What you'll do

• Implement and tune runtime controls like behavioral detection, bot defense, and rate limiting across API gateways and service meshes.
• Provide engineering teams with secure API design guidance for authentication, input validation, and error handling.
• Build automation to embed security checks, secrets scanning, and policy-as-code into CI/CD pipelines.
• Develop dashboards and analytics using API telemetry to measure risk and control effectiveness.
• Define governance for API inventories, ownership, classification, and security requirements.
• Integrate security requirements into backlog planning, threat modeling, and incident response workflows.
• Map security controls to industry frameworks like NIST, ISO 27001, and PCI DSS for audit readiness.
• Evaluate and pilot emerging technologies for API discovery and posture management.

What we're looking for

• Must possess valid and unrestricted U.S. work authorization.
• Bachelor’s degree in computer science, a relevant field, or an equivalent combination of education, work, and/or military experience.
• 5+ years of related IT and cyber protection experience (preferred).
• Strong foundation in API security concepts including authN/authZ (OAuth2/OIDC, JWT), session/token handling, rate limiting, and schema validation.
• Practical experience with runtime protection in API gateways, WAF/WAAP, service mesh, ingress controllers, or specialized API security platforms.
• Experience building automation in CI/CD and cloud-native environments using policy-as-code, scripting, and Git-based workflows.
• Expert knowledge of and experience maintaining cyber technologies such as Traceable, Salt Security, and NoName.
• CISSP or other professional cyber certification (preferred).