{"schemaVersion":"jobsearcher.job.v1","id":"6b0ff65c48e99b8dfa75375e","url":"https://jobsearcher.com/jobs/6b0ff65c48e99b8dfa75375e","canonicalUrl":"https://jobsearcher.com/jobs/6b0ff65c48e99b8dfa75375e","title":"API Security Engineer","description":"Design, deploy, integrate, administer, and optimize enterprise API and application security controls across cloud, on-premises, containerized, and hybrid environments\r\nPartner with application development, security architecture, DevOps/SRE, cloud, network, SOC, middleware, and platform engineering teams to identify risks and implement protections\r\nPerform API discovery, inventory, classification, and security posture management\r\nAnalyze API traffic, endpoints, parameters, authentication mechanisms, sensitive-data flows, and behavioral patterns\r\nIdentify API vulnerabilities including BOLA/IDOR, broken authentication and authorization, injection, SSRF, excessive data exposure, misconfigurations, and business-logic abuse\r\nAssess APIs against OWASP API Security Top 10 and organizational standards\r\nInvestigate API security alerts and coordinate remediation\r\nIntegrate API findings with SIEM, SOAR, vulnerability management, incident response, and ticketing workflows\r\nDesign, deploy, configure, maintain, troubleshoot, and monitor eBPF-based API security agents and sensors across Linux, containers, Kubernetes, and cloud environments\r\nIntegrate API security platforms with API gateways, middleware, reverse proxies, ingress controllers, and traffic-management technologies\r\nReview gateway policies for authentication, authorization, rate limiting, TLS/mTLS, data exposure, routing, and security weaknesses\r\nDeploy, configure, administer, and optimize WAF/WAAP controls; tune policies, custom rules, rate controls, network/IP controls, and application protections\r\nAnalyze HTTP/HTTPS traffic and security events; investigate application-layer attacks and false positives\r\nOnboard applications and APIs to web and API protection services\r\nPerform security architecture reviews and threat modeling for APIs, web applications, microservices, gateways, middleware, Kubernetes, containers, and cloud environments\r\nReview OAuth 2.0, OIDC, JWT, API key, mTLS, IAM, and RBAC architectures\r\nPerform application and API security assessments using manual and automated testing\r\nUse intercepting proxies, API clients, command-line tools, SAST, DAST, SCA, and API security testing technologies\r\nIntegrate security testing into CI/CD and DevSecOps pipelines\r\nDevelop automation using Python, Bash, PowerShell, Go, JavaScript, APIs, or similar technologies\r\nAutomate agent deployment, configuration validation, API onboarding, security testing, reporting, alert enrichment, and vulnerability-management workflows\r\nExplain vulnerabilities to developers, recommend remediation, and validate fixes\r\nServe as a technical subject-matter expert for enterprise API and application security and implement scalable secure-by-design solutionsRequirementsBachelor’s degree in Cybersecurity, Computer Science, Information Technology, Information Systems, Computer Engineering, Software Engineering, or a related technical discipline and relevant professional experience; or equivalent combination of college education, technical training, industry certifications, and hands‑on cybersecurity experience\r\nAssociate degree, relevant college coursework, technical certifications, or substantial professional experience may be considered in lieu of a four‑year degree\r\nDemonstrated professional experience in API security, application security, WAF/WAAP engineering, security architecture, DevSecOps, cloud security, vulnerability management, or security engineering\r\nHands‑on experience deploying and supporting enterprise API security, application security, API gateway, and traffic‑monitoring technologies strongly preferred\r\nHands‑on experience with enterprise API security technologies\r\nExperience deploying, configuring, and tuning WAF/WAAP security controls\r\nUnderstanding of eBPF‑based agent/sensor deployment and troubleshooting in Linux, Kubernetes, containerized, and cloud environments\r\nExperience integrating API security platforms with enterprise API gateways and API management technologies\r\nStrong knowledge of HTTP/HTTPS, DNS, TLS/mTLS, REST, GraphQL, JSON, OpenAPI/Swagger, web services, and API gateway architectures\r\nStrong understanding of the OWASP API Security Top 10 and OWASP Top 10\r\nKnowledge of OAuth 2.0, OIDC, JWT, API keys, IAM, RBAC, and modern API authorization models\r\nExperience performing security architecture reviews and threat modeling\r\nWorking knowledge of public cloud platforms, Kubernetes, containers, Linux, and microservices\r\nExperience with secure SDLC, DevSecOps, CI/CD, vulnerability management, and incident‑response processes\r\nAbility to troubleshoot complex integrations across applications, gateways, middleware, networks, security controls, and cloud infrastructure\r\nAbility to work directly with developers, architects, API gateway teams, middleware engineers, DevOps/SRE, cloud, network, SOC, and infrastructure teams\r\nPreferred experience with enterprise‑scale API and application security environments, eBPF‑based API traffic collection, Kubernetes/Linux sensor deployments, cloud‑based API management solutions, enterprise gateway appliances, API gateways, reverse proxies, service meshes, ingress controllers, load‑balancing technologies, SIEM/SOAR platforms, penetration testing, adversarial API/application security assessments, STRIDE, attack trees, and enterprise‑scale security tooling automation\r\nRelevant industry certifications are preferred but not requiredCore Competencies\r\nDemonstrates expertise in API security, application security, and WAF/WAAP engineering, with a strong focus on integrating security into CI/CD and DevSecOps pipelines. Proficient in analyzing and mitigating API vulnerabilities while collaborating with cross‑functional teams to implement secure solutions across diverse environments.\r\nHighest-signal resume keywordsAPI Security\r\nWAF/WAAP Engineering\r\nDevSecOps\r\nSecurity Architecture\r\nVulnerability ManagementHard SkillsAPI Discovery\r\nAPI Vulnerability Assessment\r\nEBPF‑Based Agent Deployment\r\nSecurity Testing Technologies\r\nHTTP/HTTPS Analysis\r\nOAuth 2.0\r\nJWT\r\nREST\r\nGraphQL\r\nSecure SDLCSoft SkillsCollaboration\r\nCommunication\r\nProblem‑SolvingIndustry KeywordsOWASP API Security Top 10\r\nCloud Security\r\nMicroservices\r\nIncident Response\r\nThreat ModelingTools & TechnologiesSIEM\r\nSOAR\r\nAPI Gateways\r\nKubernetes\r\nLinux\r\nContainers\r\nTraffic Management Technologies\r\nCommand‑Line Tools\r\nIntercepting Proxies\r\nAPI Clients#J-18808-Ljbffr","company":"Jobtailor","rawCompany":"jobtailor","city":"Brooklyn","state":"OH","isRemote":false,"isActive":false,"createdAt":"2026-10-04T02:48:39.460Z","occupations":[{"code":"15-1299.05","title":"Information Security Engineers","slug":"information-security-engineers"},{"code":"15-1299.08","title":"Computer Systems Engineers/Architects","slug":"computer-systems-engineers-architects"},{"code":"15-1212.00","title":"Information Security Analysts","slug":"information-security-analysts"}],"industries":[{"code":"541512","title":"Computer Systems Design Services","slug":"computer-systems-design-services"},{"code":"541511","title":"Custom Computer Programming Services","slug":"custom-computer-programming-services"},{"code":"513210","title":"Software Publishers","slug":"software-publishers"}],"jobPosting":{"@context":"https://schema.org","@type":"JobPosting","title":"API Security Engineer","description":"Design, deploy, integrate, administer, and optimize enterprise API and application security controls across cloud, on-premises, containerized, and hybrid environments\r\nPartner with application development, security architecture, DevOps/SRE, cloud, network, SOC, middleware, and platform engineering teams to identify risks and implement protections\r\nPerform API discovery, inventory, classification, and security posture management\r\nAnalyze API traffic, endpoints, parameters, authentication mechanisms, sensitive-data flows, and behavioral patterns\r\nIdentify API vulnerabilities including BOLA/IDOR, broken authentication and authorization, injection, SSRF, excessive data exposure, misconfigurations, and business-logic abuse\r\nAssess APIs against OWASP API Security Top 10 and organizational standards\r\nInvestigate API security alerts and coordinate remediation\r\nIntegrate API findings with SIEM, SOAR, vulnerability management, incident response, and ticketing workflows\r\nDesign, deploy, configure, maintain, troubleshoot, and monitor eBPF-based API security agents and sensors across Linux, containers, Kubernetes, and cloud environments\r\nIntegrate API security platforms with API gateways, middleware, reverse proxies, ingress controllers, and traffic-management technologies\r\nReview gateway policies for authentication, authorization, rate limiting, TLS/mTLS, data exposure, routing, and security weaknesses\r\nDeploy, configure, administer, and optimize WAF/WAAP controls; tune policies, custom rules, rate controls, network/IP controls, and application protections\r\nAnalyze HTTP/HTTPS traffic and security events; investigate application-layer attacks and false positives\r\nOnboard applications and APIs to web and API protection services\r\nPerform security architecture reviews and threat modeling for APIs, web applications, microservices, gateways, middleware, Kubernetes, containers, and cloud environments\r\nReview OAuth 2.0, OIDC, JWT, API key, mTLS, IAM, and RBAC architectures\r\nPerform application and API security assessments using manual and automated testing\r\nUse intercepting proxies, API clients, command-line tools, SAST, DAST, SCA, and API security testing technologies\r\nIntegrate security testing into CI/CD and DevSecOps pipelines\r\nDevelop automation using Python, Bash, PowerShell, Go, JavaScript, APIs, or similar technologies\r\nAutomate agent deployment, configuration validation, API onboarding, security testing, reporting, alert enrichment, and vulnerability-management workflows\r\nExplain vulnerabilities to developers, recommend remediation, and validate fixes\r\nServe as a technical subject-matter expert for enterprise API and application security and implement scalable secure-by-design solutionsRequirementsBachelor’s degree in Cybersecurity, Computer Science, Information Technology, Information Systems, Computer Engineering, Software Engineering, or a related technical discipline and relevant professional experience; or equivalent combination of college education, technical training, industry certifications, and hands‑on cybersecurity experience\r\nAssociate degree, relevant college coursework, technical certifications, or substantial professional experience may be considered in lieu of a four‑year degree\r\nDemonstrated professional experience in API security, application security, WAF/WAAP engineering, security architecture, DevSecOps, cloud security, vulnerability management, or security engineering\r\nHands‑on experience deploying and supporting enterprise API security, application security, API gateway, and traffic‑monitoring technologies strongly preferred\r\nHands‑on experience with enterprise API security technologies\r\nExperience deploying, configuring, and tuning WAF/WAAP security controls\r\nUnderstanding of eBPF‑based agent/sensor deployment and troubleshooting in Linux, Kubernetes, containerized, and cloud environments\r\nExperience integrating API security platforms with enterprise API gateways and API management technologies\r\nStrong knowledge of HTTP/HTTPS, DNS, TLS/mTLS, REST, GraphQL, JSON, OpenAPI/Swagger, web services, and API gateway architectures\r\nStrong understanding of the OWASP API Security Top 10 and OWASP Top 10\r\nKnowledge of OAuth 2.0, OIDC, JWT, API keys, IAM, RBAC, and modern API authorization models\r\nExperience performing security architecture reviews and threat modeling\r\nWorking knowledge of public cloud platforms, Kubernetes, containers, Linux, and microservices\r\nExperience with secure SDLC, DevSecOps, CI/CD, vulnerability management, and incident‑response processes\r\nAbility to troubleshoot complex integrations across applications, gateways, middleware, networks, security controls, and cloud infrastructure\r\nAbility to work directly with developers, architects, API gateway teams, middleware engineers, DevOps/SRE, cloud, network, SOC, and infrastructure teams\r\nPreferred experience with enterprise‑scale API and application security environments, eBPF‑based API traffic collection, Kubernetes/Linux sensor deployments, cloud‑based API management solutions, enterprise gateway appliances, API gateways, reverse proxies, service meshes, ingress controllers, load‑balancing technologies, SIEM/SOAR platforms, penetration testing, adversarial API/application security assessments, STRIDE, attack trees, and enterprise‑scale security tooling automation\r\nRelevant industry certifications are preferred but not requiredCore Competencies\r\nDemonstrates expertise in API security, application security, and WAF/WAAP engineering, with a strong focus on integrating security into CI/CD and DevSecOps pipelines. Proficient in analyzing and mitigating API vulnerabilities while collaborating with cross‑functional teams to implement secure solutions across diverse environments.\r\nHighest-signal resume keywordsAPI Security\r\nWAF/WAAP Engineering\r\nDevSecOps\r\nSecurity Architecture\r\nVulnerability ManagementHard SkillsAPI Discovery\r\nAPI Vulnerability Assessment\r\nEBPF‑Based Agent Deployment\r\nSecurity Testing Technologies\r\nHTTP/HTTPS Analysis\r\nOAuth 2.0\r\nJWT\r\nREST\r\nGraphQL\r\nSecure SDLCSoft SkillsCollaboration\r\nCommunication\r\nProblem‑SolvingIndustry KeywordsOWASP API Security Top 10\r\nCloud Security\r\nMicroservices\r\nIncident Response\r\nThreat ModelingTools & TechnologiesSIEM\r\nSOAR\r\nAPI Gateways\r\nKubernetes\r\nLinux\r\nContainers\r\nTraffic Management Technologies\r\nCommand‑Line Tools\r\nIntercepting Proxies\r\nAPI Clients#J-18808-Ljbffr","datePosted":"2026-10-04T02:48:39.460Z","dateModified":"2026-10-04T02:48:39.460Z","hiringOrganization":{"@type":"Organization","name":"Jobtailor","sameAs":"https://jobsearcher.com"},"jobLocation":{"@type":"Place","address":{"@type":"PostalAddress","addressLocality":"Brooklyn","addressRegion":"OH","addressCountry":"US"}},"identifier":{"@type":"PropertyValue","name":"JobSearcher","value":"6b0ff65c48e99b8dfa75375e"},"url":"https://jobsearcher.com/jobs/6b0ff65c48e99b8dfa75375e"}}