Description

Secure web APIs and applications by implementing threat-based requirements and security design patterns.

Responsibilities

• Develop and maintain API security standard requirements and design patterns.
• Validate API security controls against vulnerability testing tool outputs to ensure auditability.
• Perform ongoing governance with API owners to implement threat-based requirements.
• Serve as a technical advisor to application teams on API security design principles.
• Collaborate as a subject matter expert to drive secure SDLC practices.

Required Skills

• Hands-on experience developing and securing REST, SOAP, and gRPC web APIs.
• Direct experience with security testing of web services and web APIs.
• Proven ability leading threat modelling exercises for applications and services.
• Deep understanding of API identity and access management including OAuth 2.0, OIDC, and JWT.
• Strong knowledge of cryptography controls for data at rest, in motion, and in-use.
• Experience with NIST 800-53, NIST CSF, OWASP, and SANS Top 25 frameworks.
• Proficiency in Java, JavaScript, and mobile application development.
• Familiarity with Oracle, SQL, and NoSQL database architectures.
• Knowledge of service-oriented architectures and web services security.

Preferred Skills

• Experience architecting and securing AWS, Google App Engine, Azure, or Oracle Cloud.
• Experience with DevOps processes in Cloud/SaaS environments.
• Knowledge of Go or Rust programming languages.

Key Skills

Education

ANY GRADUATE