Senior API Security Engineer

Encora Inc.; Kampung Malaysia Tambahan; On-site; MYR 120,000 - 170,000; Full time

Job summary

Encora Inc. seeks a security specialist to defend APIs at the design and runtime levels in our Kuala Lumpur area team.

You will implement OAuth2/OIDC, JWT, and GraphQL security, script automated tests, and collaborate with Platform for gateway hardening while aligning with external API integrations.

Qualifications

• Strong scripting with Python for automating API attacks.
• Deep knowledge of REST and GraphQL security.
• Experience with OAuth 2.0 and OpenID Connect (OIDC) flows.
• Familiarity with API security tooling (Postman, Burp Suite, 42Crunch).

Responsibilities

• Identify business logic vulnerabilities (BOLA/IDOR, mass assignment) overlooked by firewalls.
• Design and validate OAuth2, OIDC, and JWT implementations to ensure users access only their own data.
• Script automated attacks against API Gateway to validate rate limits and fraud detection rules.
• Configure API Gateway (Kong or Azure API Gateway) for maximum security with Platform alignment.
• Deliver security patterns for auth, SSO/MFA; standardize external API usage (Open Banking) and endpoint protection.

Skills

Python scripting

REST API security

GraphQL security

OAuth 2.0 / OIDC

JWT

API security tools

Tools

Kong

Azure API Gateway

Job description

Key Responsibilities

• API Logic Security: Hunt for Business Logic vulnerabilities (BOLA/IDOR, Mass Assignment) that traditional firewalls miss.
• Authentication & Authorization: Design and validate OAuth2, OIDC, and JWT implementations to ensure users can only access their own data.
• Attack Simulation: Script automated attacks against the API Gateway to test rate limiting and fraud detection rules.
• Gateway Hardening: Work with the Platform team to configure the API Gateway (Kong, or Azure API Gateway) for maximum security.
• Auth & Partner Integration: Deliver new security design patterns and components for authentication, authorization, SSO, MFA, and Partner security. Standardize how we consume external APIs (Open Banking) and how we secure our own exposed endpoints.

Technical Requirements

• Strong scripting skills (Python) to automate API attacks.
• Expertise in REST and GraphQL security.
• Deep knowledge of OAuth 2.0 and OpenID Connect (OIDC) flows.
• Experience with API Security tools (Postman, Burp Suite, 42Crunch).