Senior API Security Engineer & SDLC Leader

Athenahealth India; Boston (MA); On-site; USD 143,000 - 243,000; Full time

Job summary

athenahealth is seeking a Lead Security Engineer to advance security capabilities across product development, with a strong emphasis on API security. You will own security strategy, testing programs, and the operation of secure platforms in collaboration with scrum teams and engineering leadership.

The role requires a solid software engineering background, hands-on cloud/containers experience, and knowledge of modern authentication standards.

Qualifications

• Bachelor’s degree in CS/CE/Cyber Security or equivalent.
• 3+ years as software developer and 3–5 years in a security-focused development role in an agile environment.
• Experience in software design, architecture, product security, and security issue prevention and mitigation.
• Strong software engineering background with ability to develop, review, and troubleshoot code.
• Hands-on experience with cloud platforms, containers, infrastructure as code, secrets management, and CI/CD.
• Knowledge of HIPAA, HITRUST, and PCI-DSS is a plus.

Responsibilities

• Socialize and drive execution of security best practices across R&D; socialize and drive SDLC adoption.
• Own evaluation, design, implementation, integration, reliability, and continuous improvement of application security capabilities.
• Lead the API security testing program: API discovery, authenticated/unauthenticated testing, findings routing, and ownership mapping.
• Partner with DevOps, IAM, API Gateway, NOC, Enterprise Security, and application teams to design and operate security-hardened platforms.

Skills

Software development

Security engineering

APIs security

OAuth 2.0 / OpenID Connect / JWT

REST / JSON

SAST / SCA / DAST

CI/CD security

Cloud platforms

Docker

Terraform

Education

Bachelor's degree in CS/CE/Cyber Security

Tools

Docker

Terraform

Job description

athenahealth is seeking a Lead Security Engineer to advance security capabilities across product development, with a strong emphasis on API security. You will own security strategy, testing programs, and the operation of secure platforms in collaboration with scrum teams and engineering leadership.

The role requires a solid software engineering background, hands-on cloud/containers experience, and knowledge of modern authentication standards.