Description

Secure web APIs and applications by establishing standards and driving threat-based requirements across the organization.

Responsibilities

• Develop and maintain API security standard requirements and design patterns.
• Validate security control implementation against vulnerability testing tool outputs.
• Perform ongoing governance with API owners to ensure threat-based requirements are met.
• Act as a technical advisor to application teams on API security design principles.

Required Skills

• Hands-on experience developing and securing REST, SOAP, and gRPC web APIs.
• Experience performing security testing for web services and web APIs.
• Proven ability leading threat modelling exercises for applications and services.
• Deep understanding of OAuth 2.0, OIDC, and JWT identity and access management.
• Knowledge of cryptography controls for data at rest, in motion, and in use.
• Familiarity with NIST 800-53, NIST CSF, OWASP, and SANS Top 25 frameworks.
• Experience with Java, JavaScript, and mobile application development.
• Experience with service-oriented architectures and secure SDLC practices.

Preferred Skills

• Experience with DevOps processes in Cloud/SaaS environments.
• Experience architecting and securing AWS, Google App Engine, Azure, or Oracle Cloud.

Key Skills

Education

Any graduate