API Security Engineer — WAF/WAAP & eBPF Expert

KeyCorp; Brooklyn (OH); Hybrid; USD 116,000 - 216,000; Full time

Benefits offered by this job

Health insurance

401(k) matching

Performance bonus

Job summary

KeyCorp is hiring an experienced API Security Engineer to design, deploy, and optimize enterprise API security controls across cloud, on-premises, and hybrid environments. You will partner with development, security architecture, DevOps, and platform teams to identify risks, implement protections, and automate security processes.

The role focuses on API security, WAF/WAAP, eBPF-based monitoring, and threat modeling, ensuring secure-by-design practices across complex architectures.

Qualifications

• Bachelor’s degree in cybersecurity, CS, IT, or related field; or equivalent experience.
• Proven experience with API security, WAF/WAAP engineering, and security architecture.
• Hands-on with eBPF-based sensors in Linux/Kubernetes environments.
• Experience integrating security with API gateways and API management.
• Knowledge of OAuth 2.0, OIDC, JWT, TLS/mTLS, and RBAC.

Responsibilities

• Deploy and optimize enterprise API security platforms and controls.
• Analyze API traffic, endpoints, and data flows for vulnerabilities.
• Design and maintain eBPF-based security agents across environments.
• Integrate security telemetry with SIEM/SOAR and incident-response workflows.
• Collaborate with DevOps, developers, and cloud teams to remediate risks.

Skills

API security

WAF/WAAP

eBPF

Kubernetes

Threat modeling

CI/CD

Python

Education

Bachelor’s degree in CS/Cybersecurity

Tools

SIEM/SOAR

OpenAPI/Swagger

API gateways

Job description

KeyCorp is hiring an experienced API Security Engineer to design, deploy, and optimize enterprise API security controls across cloud, on-premises, and hybrid environments. You will partner with development, security architecture, DevOps, and platform teams to identify risks, implement protections, and automate security processes.

The role focuses on API security, WAF/WAAP, eBPF-based monitoring, and threat modeling, ensuring secure-by-design practices across complex architectures.