IBM API Connect

Nisum; Hyderabad; On-site; INR 1,800,000 - 3,200,000; Full time

Job summary

Nisum is seeking an API engineer to design, secure, and govern APIs using IBM API Connect in Hyderabad. You will collaborate with Enterprise Architecture, Security, QA, and Release Management to implement robust authentication, authorization, and policy-driven processing.

You will develop GatewayScript in JavaScript, manage JWT/OAuth 2.0 based security, and optimize API performance across environments with CI/CD integration and version control practices.

Qualifications

• Experience designing and implementing APIs with IBM API Connect.
• Strong security design using JWT, OAuth 2.0.
• Experience with DataPower Gateway components.
• Proficiency in GatewayScript and JavaScript.
• Experience with CI/CD and version control (Git/Bitbucket).

Responsibilities

• Design, develop, test, deploy, and maintain APIs on IBM API Connect.
• Collaborate with cross-functional teams to define API requirements.
• Implement API security controls and token lifecycle management.
• Develop GatewayScript for transformations, validation, and logging.
• Configure and troubleshoot DataPower Gateway components.
• Manage environment-specific configuration and CI/CD integration.
• Perform API performance analysis and troubleshooting.
• Conduct RCA for API security and deployment issues.

Skills

API design

API security

JWT

OAuth 2.0

GatewayScript

CI/CD

DataPower

Security testing

Governance

Performance optimization

Tools

IBM API Connect

IBM DataPower Gateway

apic CLI

Git/Bitbucket

Node.js/JavaScript

XML/JSON

Job description

Design, develop, test, deploy, and maintain APIs using IBM API Connect, ensuring alignment with business, integration, security, and architectural requirements.

Collaborate with business stakeholders, development teams, Enterprise Architecture, Security, QA, Platform, and Release Management teams to define API requirements, specifications, and implementation approaches.

Design and implement API security and access controls using JWT, OAuth 2.0, Client ID/Client Secret, and other authentication and authorization mechanisms based on consumer and business requirements.

Develop and maintain custom API Connect policies to implement organization-specific authentication, authorization, security, validation, transformation, logging, and API processing requirements.

Develop and maintain GatewayScript using JavaScript for request/response transformation, validation, error handling, logging, backend integration, and security processing.

Design, implement, and troubleshoot JWT-based authentication and authorization, including token structure, claims, expiration, issuer/audience validation, and token lifecycle management.

Implement and support JWS and JWE, including token signing, signature verification, encryption/decryption, cryptographic algorithms, and secure key usage.

Manage cryptographic keys for API security, including signing keys, symmetric keys, key validity, expiration, rotation, and environment-specific configuration.

Implement kid-based JWT key rotation, including active/backup key management, grace-period handling, validation against rotated keys, and retirement of expired keys.

Configure, maintain, and troubleshoot IBM DataPower Gateway components supporting API Connect, including gateway policies, policy assemblies, Invoke policies, header controls, and runtime processing.

Implement environment-specific configuration externalization using API Connect Catalog Property Overrides, enabling consistent API and policy promotion across environments without code changes.

Use the IBM API Connect CLI (apic) for API, Product, Policy, deployment, and troubleshooting activities.

Integrate API and custom policy development with Git/Bitbucket and CI/CD pipelines, including branching, build validation, policy packaging, release promotion, and environment-specific deployments.

Perform API performance analysis and optimization, identifying bottlenecks across gateway policies, custom scripts, backend integrations, and runtime processing.

Implement API logging, monitoring, and request correlation, including propagation and use of correlation identifiers across gateway and backend services.

Troubleshoot complex API Connect and DataPower issues by analyzing HTTP responses, gateway errors, policy execution, authentication failures, request/response headers, backend responses, configuration differences, and gateway logs.

Conduct root-cause analysis (RCA) for API security, integration, deployment, configuration, connectivity, and production issues, and drive corrective and preventive actions.

Perform API lifecycle management, including API/Product versioning, staging, publishing, subscription management, deprecation, retirement, and controlled promotion across environments.

Contribute to API security, governance, and production readiness, including security classification, authentication-tier selection, risk assessment, security exception management, design reviews, and production readiness reviews.

Develop and maintain API governance standards, reference architectures, security guidelines, API design standards, checklists, and CI/CD quality gates.

Evaluate and implement API platform and security enhancements, including custom authentication policies, security key externalization, JWT key rotation, OAuth 2.0 adoption, and API governance improvements.Kindly share the below details