API Security Engineer: Secure Modern APIs

Moderna; Cambridge (MA); Hybrid; USD 122,000 - 195,000; Full time

Benefits offered by this job

Healthcare

Well-being resources

Generous PTO

Location-specific perks

Job summary

Moderna is seeking a Cybersecurity Engineer to design, implement, and mature API security across applications, platforms, and AI-enabled use cases. You will collaborate across engineering and security teams to improve API exposure, authentication, monitoring, and governance.

The role emphasizes threat modeling, secure API engineering, and non-human identity patterns, with a 70/30 in-office work model and comprehensive benefits.

Qualifications

• Strong hands-on experience with API security concepts and controls.
• Experience securing REST, GraphQL, or other modern API patterns in cloud-native environments.
• Familiarity with API gateways, service meshes, reverse proxies.
• Ability to perform threat modeling and risk assessments for APIs and machine-to-machine interactions.
• Knowledge of identity and access concepts for non-human/workload identities.

Responsibilities

• Help design, implement, and mature Moderna’s API security capabilities across enterprise applications and platforms.
• Support evaluation and deployment of API security technologies for discovery, posture, traffic monitoring, anomaly detection, and policy enforcement.
• Partner with engineering teams to identify insecure API designs and risky patterns; drive remediation.
• Perform API-focused threat modeling and security assessments for modern services and AI-enabled workflows.
• Define secure API engineering practices including authentication, authorization, rate limiting, and secrets handling.
• Shape security approaches for non-human identities and agentic access patterns.

Skills

API security

Threat modeling

Cloud security

Identity concepts

Secure API design

Tools

API gateways

Service meshes

Reverse proxies

Job description

Moderna is seeking a Cybersecurity Engineer to design, implement, and mature API security across applications, platforms, and AI-enabled use cases. You will collaborate across engineering and security teams to improve API exposure, authentication, monitoring, and governance.

The role emphasizes threat modeling, secure API engineering, and non-human identity patterns, with a 70/30 in-office work model and comprehensive benefits.