API Security Engineer: Secure APIs & AI-Ready Apps

BioSpace; Cambridge (MA); On-site; USD 122,000 - 195,000; Full time

Benefits offered by this job

Healthcare

Well-being resources

Paid time off

Retirement benefits

Location benefits

Job summary

Moderna is seeking a Cybersecurity Engineer to design, implement, and mature API security across Moderna’s API landscape, encompassing enterprise apps, shared services, and AI-enabled platforms.

You will partner with engineering, architecture, and security teams to improve how APIs are exposed, authenticated, monitored, and governed, while advancing identity models for machine-to-machine access and agentic interactions with APIs.

Qualifications

• 5+ years of cybersecurity or related engineering experience with hands-on API security.
• Understanding of API security risks: authentication, authorization, data exposure.
• Experience with REST/GraphQL in cloud-native environments.

Responsibilities

• Design, implement, and mature API security across applications and platform services.
• Evaluate and operationalize API security technologies for discovery, posture, and policy enforcement.
• Identify insecure API designs and improve authentication/authorization patterns and data exposure.
• Perform API threat modeling and security assessments for modern services and AI-enabled workflows.
• Promote secure API engineering practices including authentication, rate limiting, and secrets handling.
• Address non-human identities and agentic access patterns for APIs and services.
• Analyze telemetry to identify abuse, misconfigurations, and gaps; drive remediation with stakeholders.
• Collaborate with cloud, identity, and detection teams to close API security gaps.

Skills

API security

Threat modeling

Cloud security

Identity concepts

Communication skills

Security architecture

Tools

API gateways

Service meshes

Job description

Moderna is seeking a Cybersecurity Engineer to design, implement, and mature API security across Moderna’s API landscape, encompassing enterprise apps, shared services, and AI-enabled platforms.

You will partner with engineering, architecture, and security teams to improve how APIs are exposed, authenticated, monitored, and governed, while advancing identity models for machine-to-machine access and agentic interactions with APIs.