API Security Engineer: Protect AI‑Driven APIs

RXinsider LTD.; Cambridge (MA); Hybrid; USD 146,000 - 234,000; Full time

Benefits offered by this job

Competitive healthcare

Well-being resources

Family planning support

Generous PTO & holidays

Equity or incentive opportunities

Job summary

Moderna is seeking a Cybersecurity Engineer to design, implement, and mature API security across enterprise apps, platform services, and AI-enabled use cases. You will improve API exposure, authentication, monitoring, and governance while addressing evolving identity models and non-human access.

Work with engineering and security teams to mitigate risks, shape secure API practices, and drive remediation for telemetry findings. A hybrid in-office model supports collaboration and growth.

Qualifications

• Hands-on API security experience across modern applications and platforms.
• Ability to identify insecure API designs, weak authentication, and data exposure.
• Experience with API gateways, service meshes, and monitoring controls.

Responsibilities

• Design, implement, and mature Moderna’s API security across applications, services, and AI platforms.
• Evaluate, deploy, and operationalize API security tech for discovery, posture, monitoring, anomaly detection, and policy enforcement.
• Collaborate across engineering, platform, and security teams to fix insecure API patterns and strengthen trust.
• Perform API-centric threat modeling and risk assessments for APIs and machine-to-machine interactions.
• Promote secure API engineering practices: strong auth, rate limiting, schema validation, and secrets handling.

Skills

API security

Threat modeling

REST/GraphQL security

Identity & access

Cloud security

Communication

Job description

Moderna is seeking a Cybersecurity Engineer to design, implement, and mature API security across enterprise apps, platform services, and AI-enabled use cases. You will improve API exposure, authentication, monitoring, and governance while addressing evolving identity models and non-human access.

Work with engineering and security teams to mitigate risks, shape secure API practices, and drive remediation for telemetry findings. A hybrid in-office model supports collaboration and growth.