below marketmost similar roles pay hereabove market
This role pays less than
67%
of similar roles. Most pay
$151,393–$216,000
— the blue band above.
At the midpoint, this role pays about
$155k
versus about
$184k
for comparable roles.
Based on 240 similar postings.
Employer
About McDonald’s Corporation
McDonald’s Corporation is the world's largest fast-food chain by revenue, operating over 40,000 locations in more than 100 countries.
McDonald’s Corporation currently has
25 open roles
on FindRole.
Listed pay typically runs
$138,207–$172,758
across 24 roles with salary data.
The Sr External Web Application & API Security Engineer serves as a hands-on technical lead within the Application & API Security team. This role focuses on enterprise API security and web application protection across cloud, on-premises, and partner environments. Key responsibilities include leading API discovery, posture management, and runtime protection while designing and tuning WAF, rate-limiting, bot management, and DDoS controls. The engineer will assess risks related to the OWASP API Security Top 10, including authentication weaknesses and business logic abuse. Required technical skills include experience with REST, GraphQL, SOAP, gRPC, OAuth 2.0, OpenID Connect, JWT, and TLS. Candidates must utilize tools like Terraform, Git, and CI/CD pipelines to automate security workflows. The work involves securing high-volume digital platforms and microservices against credential abuse and data exfiltration.
Lead the engineering and operationalization of API discovery, posture management, and runtime protection across cloud and on-premises environments.
Design, operate, and tune WAF, rate-limiting, bot management, and DDoS controls for high-availability digital services.
Assess APIs for OWASP Top 10 risks, including authentication weaknesses, data exposure, and business logic abuse.
Automate security workflows and embed validation into CI/CD and DevSecOps processes using Terraform and scripting.
Analyze API telemetry to investigate and contain incidents involving credential abuse, scraping, and data exfiltration.
Integrate security events with SIEM, SOAR, and ticketing systems to support centralized monitoring and remediation.
Develop reusable API security patterns and reference architectures for mobile, partner, and microservice integrations.
Provide technical direction, mentorship, and security design reviews to engineers and analysts.
What we're looking for
Bachelor's degree in Computer Science, Engineering, Information Technology, Cybersecurity, or a related field, or equivalent practical experience.
Five or more years of security engineering experience.
At least three years of hands-on API security experience across discovery, posture assessment, runtime monitoring, testing, architecture review, or control engineering.
Strong knowledge of REST, GraphQL, API gateways, microservices, HTTP, TLS, JSON, OAuth 2.0, OpenID Connect, JWT, API keys, mutual TLS, service identities, authorization, and common API abuse patterns.
Hands-on experience with enterprise API security and WAF platforms.
Experience analyzing security telemetry, investigating attacks, scripting in a common language, and integrating security platforms with SIEM, SOAR, ticketing, or workflow automation tools.
Experience with at least one major cloud platform (AWS, Microsoft Azure, or Google Cloud Platform), including API gateway, identity, logging, and load-balancing services.
Strong written and verbal communication skills to explain technical risk and remediation to engineering and non-technical stakeholders.
Hands-on Akamai API Security and App & API Protector experience (preferred).
OpenAPI or GraphQL schema analysis (preferred).
Terraform and Git-based deployment workflows (preferred).
Experience supporting global, high-volume digital platforms (preferred).
Berkeley Heights, NJ+212 days ago
$110,000–$186,000
API Security
OAuth2
OIDC
JWT
mTLS
CI/CD
DevSecOps
Open API
JSON Schema
SAST
DAST
WAF
WAAP
Service Mesh
Policy-as-Code
NIST
ISO 27001
PCI DSS
FAPI
OWASP
Traceable
Salt Security
NoName