API Security Engineer

Jobtailor

Brooklyn (OH)

On-site

USD 140,000 - 190,000

Full time

6 days ago

Be an early applicant

Application generator

Turn this role into an interview — a resume and cover letter built around what this employer wants.

Get past ATS filters

Job summary

Jobtailor is seeking a Senior API Security Engineer to design, deploy, and optimize security controls across cloud, on-prem, and hybrid environments.

You will partner with development, security, and operations teams to identify risks, implement protections, and automate security testing within CI/CD pipelines.

Qualifications

Bachelor’s degree or equivalent in a technical discipline with relevant cybersecurity experience
Experience with API security, WAF/WAAP engineering, security architecture, DevSecOps, cloud security, vulnerability management, or security engineering
Hands-on deployment and support of enterprise API security and API gateway technologies
Understanding of eBPF-based agent deployment and troubleshooting in Linux, Kubernetes, containers, and cloud environments
Experience with secure SDLC, CI/CD, vulnerability management, and incident-response processes

Responsibilities

Design, deploy, integrate, administer, and optimize API and application security controls across cloud, on-premises, containerized, and hybrid environments
Partner with cross-functional teams to identify risks and implement protections
Perform API discovery, inventory, classification, and security posture management
Analyze API traffic, endpoints, authentication, and sensitive-data flows
Identify API vulnerabilities and align with OWASP API Security Top 10
Integrate findings with SIEM, SOAR, and ticketing workflows
Onboard applications and APIs to protection services
Design threat modeling for APIs, microservices, gateways, and cloud environments
Review OAuth 2.0, OIDC, JWT, and RBAC architectures
Develop automation using Python, Bash, PowerShell, Go, or JavaScript
Explain vulnerabilities to developers and drive remediation

Skills

API Security

WAF/WAAP Engineering

DevSecOps

Security Architecture

Vulnerability Management

Kubernetes

Linux

Threat Modeling

Incident Response

CI/CD

Education

Bachelor’s degree in Cybersecurity/CS/IT or related field

Tools

SIEM

SOAR

API Gateways

Kubernetes

Linux

Containers

Traffic Management Technologies

Intercepting Proxies

Job description

Design, deploy, integrate, administer, and optimize enterprise API and application security controls across cloud, on-premises, containerized, and hybrid environments
Partner with application development, security architecture, DevOps/SRE, cloud, network, SOC, middleware, and platform engineering teams to identify risks and implement protections
Perform API discovery, inventory, classification, and security posture management
Analyze API traffic, endpoints, parameters, authentication mechanisms, sensitive-data flows, and behavioral patterns
Identify API vulnerabilities including BOLA/IDOR, broken authentication and authorization, injection, SSRF, excessive data exposure, misconfigurations, and business-logic abuse
Assess APIs against OWASP API Security Top 10 and organizational standards
Investigate API security alerts and coordinate remediation
Integrate API findings with SIEM, SOAR, vulnerability management, incident response, and ticketing workflows
Design, deploy, configure, maintain, troubleshoot, and monitor eBPF-based API security agents and sensors across Linux, containers, Kubernetes, and cloud environments
Integrate API security platforms with API gateways, middleware, reverse proxies, ingress controllers, and traffic-management technologies
Review gateway policies for authentication, authorization, rate limiting, TLS/mTLS, data exposure, routing, and security weaknesses
Deploy, configure, administer, and optimize WAF/WAAP controls; tune policies, custom rules, rate controls, network/IP controls, and application protections
Analyze HTTP/HTTPS traffic and security events; investigate application-layer attacks and false positives
Onboard applications and APIs to web and API protection services
Perform security architecture reviews and threat modeling for APIs, web applications, microservices, gateways, middleware, Kubernetes, containers, and cloud environments
Review OAuth 2.0, OIDC, JWT, API key, mTLS, IAM, and RBAC architectures
Perform application and API security assessments using manual and automated testing
Use intercepting proxies, API clients, command-line tools, SAST, DAST, SCA, and API security testing technologies
Integrate security testing into CI/CD and DevSecOps pipelines
Develop automation using Python, Bash, PowerShell, Go, JavaScript, APIs, or similar technologies
Automate agent deployment, configuration validation, API onboarding, security testing, reporting, alert enrichment, and vulnerability-management workflows
Explain vulnerabilities to developers, recommend remediation, and validate fixes
Serve as a technical subject-matter expert for enterprise API and application security and implement scalable secure-by-design solutions

Requirements

Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, Information Systems, Computer Engineering, Software Engineering, or a related technical discipline and relevant professional experience; or equivalent combination of college education, technical training, industry certifications, and hands‑on cybersecurity experience
Associate degree, relevant college coursework, technical certifications, or substantial professional experience may be considered in lieu of a four‑year degree
Demonstrated professional experience in API security, application security, WAF/WAAP engineering, security architecture, DevSecOps, cloud security, vulnerability management, or security engineering
Hands‑on experience deploying and supporting enterprise API security, application security, API gateway, and traffic‑monitoring technologies strongly preferred
Hands‑on experience with enterprise API security technologies
Experience deploying, configuring, and tuning WAF/WAAP security controls
Understanding of eBPF‑based agent/sensor deployment and troubleshooting in Linux, Kubernetes, containerized, and cloud environments
Experience integrating API security platforms with enterprise API gateways and API management technologies
Strong knowledge of HTTP/HTTPS, DNS, TLS/mTLS, REST, GraphQL, JSON, OpenAPI/Swagger, web services, and API gateway architectures
Strong understanding of the OWASP API Security Top 10 and OWASP Top 10
Knowledge of OAuth 2.0, OIDC, JWT, API keys, IAM, RBAC, and modern API authorization models
Experience performing security architecture reviews and threat modeling
Working knowledge of public cloud platforms, Kubernetes, containers, Linux, and microservices
Experience with secure SDLC, DevSecOps, CI/CD, vulnerability management, and incident‑response processes
Ability to troubleshoot complex integrations across applications, gateways, middleware, networks, security controls, and cloud infrastructure
Ability to work directly with developers, architects, API gateway teams, middleware engineers, DevOps/SRE, cloud, network, SOC, and infrastructure teams
Preferred experience with enterprise‑scale API and application security environments, eBPF‑based API traffic collection, Kubernetes/Linux sensor deployments, cloud‑based API management solutions, enterprise gateway appliances, API gateways, reverse proxies, service meshes, ingress controllers, load‑balancing technologies, SIEM/SOAR platforms, penetration testing, adversarial API/application security assessments, STRIDE, attack trees, and enterprise‑scale security tooling automation
Relevant industry certifications are preferred but not required

Core Competencies

Demonstrates expertise in API security, application security, and WAF/WAAP engineering, with a strong focus on integrating security into CI/CD and DevSecOps pipelines. Proficient in analyzing and mitigating API vulnerabilities while collaborating with cross‑functional teams to implement secure solutions across diverse environments.

Highest-signal resume keywords