Remote API Security Engineer – Cloud & WAAP Expert

KeyCorp; Cleveland (OH); Hybrid; USD 116,000 - 216,000; Full time

Benefits offered by this job

In-office with flexible options

Incentive compensation eligibility

Job summary

KeyCorp is seeking an API Security Engineer to design and implement enterprise API and application security controls across cloud, on-prem, and hybrid environments. You will partner with security architecture, DevOps, and engineering teams to identify risks, automate protections, and drive remediation.

You will deploy eBPF-based agents, integrate with API gateways and WAAP services, and perform threat modeling and secure-by-design reviews. Strong scripting and automation skills are valued.

Qualifications

• Hands-on API security, application security, WAF/WAAP engineering experience.
• Experience deploying security controls across cloud, on-prem, and container environments.
• Familiar with OAuth 2.0, OIDC, JWT, API keys, and mTLS concepts.
• Knowledge of OWASP API Security Top 10 and OWASP Top 10.

Responsibilities

• Deploy, configure, and optimize enterprise API security platforms and controls.
• Integrate API security with gateways, proxies, and middleware.
• Perform threat modeling and security architecture reviews for APIs and apps.
• Automate security tasks and integration into CI/CD pipelines.
• Collaborate with DevOps, security, and development teams to drive remediation.

Skills

API Security

Application Security

WAF/WAAP

eBPF

Linux

Kubernetes

API Gateway Security

OAuth 2.0

OIDC

JWT

TLS/mTLS

OpenAPI/Swagger

DevSecOps

CI/CD

Python

Threat Modeling

Cloud Security

SIEM/SOAR

Education

Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, Information Systems, Computer Engineering, Software Engineering, or related field

Tools

eBPF in Linux

API Management Platforms

API Gateways

Job description

KeyCorp is seeking an API Security Engineer to design and implement enterprise API and application security controls across cloud, on-prem, and hybrid environments. You will partner with security architecture, DevOps, and engineering teams to identify risks, automate protections, and drive remediation.

You will deploy eBPF-based agents, integrate with API gateways and WAAP services, and perform threat modeling and secure-by-design reviews. Strong scripting and automation skills are valued.