IND Lead Engineer, Security - Web Application and API Protection Security Engineer

The Hartford; India; On-site; INR 1,800,000 - 3,200,000; Full time

Job summary

The Hartford in India is seeking a Web Application and API Protection (WAAP) Engineer to join our Information Security team. You will design, implement, and manage protections for web apps and APIs, collaborating with development, cloud engineering, and network security teams.

You will deploy WAAP solutions, tune policies against OWASP Top 10 threats, monitor attacks and API abuse, and create dashboards showing risk reduction and trends.

Qualifications

• 3+ years in application security or related field.
• Hands-on experience with WAAP platforms.
• Experience securing web apps and APIs.
• Strong knowledge of OWASP Top 10.
• Ability to tune rules and analyze alerts.

Responsibilities

• Design, implement WAAP protections for web apps and APIs.
• Operate enterprise WAF/API security platforms.
• Monitor, detect, and respond to attacks and API abuse.
• Develop security policies to protect applications in cloud environments.
• Collaborate with development, cloud, and network security teams.

Skills

WAAP technologies

Akamai WAF

Apigee API

AWS WAF

Cloud Armor

OWASP Top 10

OWASP API Top 10

OAuth2 / OIDC

SAML

REST / GraphQL / SOAP

TLS/SSL

SPA/MPA

App security monitoring

SIEM

Education

Bachelor's degree in CS/Cybersecurity

Tools

Akamai WAF

Apigee API Management

AWS WAF

Google Cloud Armor

Job description

**Job Posting: Web Application and API Protection (WAAP) Engineer****Overview**We are seeking a highly skilled **Web Application and API Protection (WAAP) Engineer** to join our Information Security team. This role is responsible for designing, implementing, and managing enterprise-scale protections for web applications and APIs. The ideal candidate will have deep expertise in web application security, API security, web application firewalls (WAF), bot mitigation, DoS protection, and modern cloud-native security architectures.As a WAAP Engineer, you will work closely with application development, cloud engineering, network security, and cybersecurity teams to protect critical business services from evolving threats while enabling secure digital innovation.**Key Responsibilities*** Provide operational support and maintenance for The Hartford’s enterprise WAF and API security platforms* Design, deploy, and maintain WAAP solutions including + Threat Detection and Prevention + Vulnerability Detection and Prevention + Bot Management and Account Protection + DoS mitigation technologies* Develop and manage security policies to protect web applications, mobile applications, and APIs from OWASP Top 10 and OWASP API Top 10 threats* Monitor, analyze, and respond to application-layer attacks, malicious bot activity, and API abuse* Conduct rule tuning, false-positive analysis, and security policy optimization* Support cloud-native WAAP deployments across environments such as AWS, Azure, GCP* Create dashboards, metrics, and reports demonstrating security posture, attack trends, and risk reduction* Stay current on emerging web, API, and application security threats, vulnerabilities, and industry best practices* Participate in security incident response activities involving web applications and APIs**Required Qualifications*** Bachelor's degree in Information Security, Computer Science, Cybersecurity, or related field (or equivalent experience)* 3+ years of experience in application security, web security, network security, or a related cybersecurity role* Hands-on experience with WAAP technologies such as + Akamai WAF & API Security + Apigee API Management + AWS WAF + Google Cloud Armor* Strong understanding of + OWASP Top 10 + OWASP API Security Top 10 + Authentication and Authorization (OAuth2, OIDC, SAML) + REST, GraphQL, and SOAP APIs + TLS/SSL + SPA, MPA and Web Application architectures* Experience with API discovery, API inventory management, and API security monitoring* Experience with SIEM, security monitoring, and log analysis platforms**Preferred Qualifications*** Experience implementing enterprise WAF and API security programs* Knowledge of Secure Software Development Lifecycle (SSDLC) practices* Industry certifications such as: + CISSP + AWS Certified Security Specialty