API Security Engineer

What you'll do

• Implement and tune runtime controls such as behavior detection, bot defense, and rate limiting across API gateways and service meshes.
• Provide secure design guidance to engineering teams regarding authentication, authorization, input validation, and OWASP API Security standards.
• Build automation for the CI/CD pipeline including policy-as-code, automated security checks, and secret scanning.
• Develop dashboards and analytics from API telemetry to measure risk, control effectiveness, and program outcomes.
• Establish governance for API inventories, ownership, classification, and consistent security requirements across the organization.
• Integrate security requirements into the DevSecOps lifecycle through threat modeling, design reviews, and incident response planning.
• Map security controls to industry frameworks like NIST, ISO 27001, and PCI DSS to ensure audit readiness.
• Evaluate and pilot emerging technologies for API discovery, posture management, and runtime detection.

What we're looking for

• You must possess valid and unrestricted U.S. work authorization.
• A bachelor's degree or equivalent work experience is required.
• 5+ years of related IT and cyber protection experience are desired.
• CISSP or other professional cyber certification is desirable.
• You must have a strong foundation in API security concepts including authN/authZ, session handling, and rate limiting.
• You must have practical experience with runtime protection tools such as API gateways, WAF/WAAP, or service mesh.
• You must be able to build automation in CI/CD and cloud-native environments using policy-as-code and scripting.
• Experience with OpenAPI tooling, threat modeling, and aligning controls to financial industry standards is preferred.