API Security Engineer

What you'll do

• Implement and tune runtime controls like behavioral detection, bot defense, and rate limiting across gateways and service meshes.
• Provide engineering teams with guidance on secure API patterns including authentication, authorization, and input validation.
• Build automation to integrate security checks, policy-as-code, and scanning tools into the CI/CD pipeline.
• Develop dashboards and analytics from API telemetry to measure risk and inform leadership decisions.
• Establish governance for API inventories, ownership, classification, and consistent security standards across teams.
• Integrate security requirements into the DevSecOps lifecycle through threat modeling, design reviews, and incident response.
• Map security controls to industry frameworks like NIST, ISO 27001, and PCI DSS to ensure audit readiness.
• Evaluate and pilot emerging technologies for API discovery, posture management, and runtime detection.

What we're looking for

• 5+ years of related IT and cyber protection experience is desired.
• Bachelor’s degree in computer science, a relevant field, or an equivalent combination of education, work, and military experience.
• Strong foundation in API security concepts including OAuth2, OIDC, JWT, rate limiting, and schema validation.
• Practical experience with runtime protection using API gateways, WAF/WAAP, service mesh, or specialized API security platforms.
• Experience building automation in CI/CD and cloud-native environments using policy-as-code and scripting.
• Expert knowledge of cyber technologies such as Traceable, Salt Security, and NoName.
• CISP or other professional cyber certification is desirable.
• Must possess valid and unrestricted U.S. work authorization without requiring sponsorship.