API Security Engineer (Cloud & AI Gateways)

Moderna Therapeutics; Cambridge (MA); On-site; USD 122,000 - 195,000; Full time

Benefits offered by this job

Competitive healthcare

Well-being resources

Family planning benefits

Generous paid time off

Job summary

Moderna Therapeutics is seeking a Cybersecurity Engineer to design and mature API security across applications, platforms, and AI-enabled use cases. The role focuses on securing APIs, improving visibility, control, and risk reduction across evolving integration patterns and shared platforms.

You will partner with engineering to strengthen authentication, authorization, rate limiting, and secure service-to-service communication, while aligning with evolving identity models for human and non-human

Qualifications

• 5+ years of cybersecurity experience with hands-on API security.
• Experience with securing REST/GraphQL and cloud-native environments.
• Ability to perform threat modeling and risk assessments for APIs and integrations.
• Experience with secure identity, service-to-service trust, and non-human identities.

Responsibilities

• Design, implement, and mature Moderna’s API security capabilities.
• Evaluate and operationalize API security technologies for visibility, posture, and enforcement.
• Collaborate with engineering to identify insecure API designs and improve authentication/authorization.
• Perform API-focused threat modeling and risk assessments for modern services and AI-enabled workflows.
• Provide guidance on secure API engineering practices and trusted identity models.

Skills

API security

Threat modeling

Cloud security

REST/GraphQL

Identity concepts

Tools

API gateways

Service meshes

Reverse proxies

Job description

Moderna Therapeutics is seeking a Cybersecurity Engineer to design and mature API security across applications, platforms, and AI-enabled use cases. The role focuses on securing APIs, improving visibility, control, and risk reduction across evolving integration patterns and shared platforms.

You will partner with engineering to strengthen authentication, authorization, rate limiting, and secure service-to-service communication, while aligning with evolving identity models for human and non-human