Senior API Security Engineer | Cloud, WAAP & eBPF

KeyBank; Brooklyn (OH); On-site; USD 116,000 - 216,000; Full time

Benefits offered by this job

In-office presence

Flexible work options

Job summary

KeyBank is seeking an experienced API Security Engineer to design, deploy, and manage enterprise API and application security controls across cloud, on‑premises, containerized, and hybrid environments. The role partners with development, security, DevOps, and platform teams to identify risks, implement protections, and drive remediation.

The ideal candidate has hands‑on API security, WAF/WAAP, API gateway, and threat modeling experience, plus strong collaboration skills to integrate with

Qualifications

• Bachelor’s degree in Cybersecurity, Computer Science, IT, or related field or equivalent experience.
• Hands-on experience deploying enterprise API security, WAF/WAAP, and API gateway platforms.
• Experience with security architecture reviews, threat modeling, CI/CD, and vulnerability management.

Responsibilities

• Deploy, configure, and optimize enterprise API security platforms and controls.
• Perform API discovery, inventory, and security posture management.
• Identify shadow, rogue, zombie, deprecated, and undocumented APIs.
• Analyze API traffic, endpoints, authentication mechanisms, and data exposure.
• Investigate API security alerts and coordinate remediation with engineering teams.
• Integrate security findings with SIEM, SOAR, and ticketing workflows.

Skills

API Security

Application Security

WAF/WAAP

eBPF

Linux

Kubernetes

API Gateway Security

API Management

Threat Modeling

CI/CD

Python

Security Automation

Cloud Security

Education

Bachelor’s degree in cybersecurity or related field

Tools

OpenAPI/Swagger

Job description

KeyBank is seeking an experienced API Security Engineer to design, deploy, and manage enterprise API and application security controls across cloud, on‑premises, containerized, and hybrid environments. The role partners with development, security, DevOps, and platform teams to identify risks, implement protections, and drive remediation.

The ideal candidate has hands‑on API security, WAF/WAAP, API gateway, and threat modeling experience, plus strong collaboration skills to integrate with