Description

You will design and enforce security practices for RESTful and GraphQL APIs across cloud-native and containerized environments.

Responsibilities

• Analyze and secure APIs across internal, partner, and third-party integrations.
• Implement authentication and authorization using OAuth, OpenID Connect, JWT, and API keys.
• Build and enforce security policies through API gateways like Apigee, Kong, Mulesoft, AWS API Gateway, or Azure API Management.
• Perform API threat modeling, risk assessments, and penetration testing.
• Integrate security testing tools such as OWASP ZAP, Burp Suite, and Postman into CI/CD pipelines.
• Monitor for API abuse, misconfiguration, broken access control, and excessive data exposure.
• Collaborate with developers to address OWASP API Top 10 issues and apply secure coding standards.
• Support log analysis, incident response, and forensic investigation related to API traffic.

Required Skills

• 8–10 years of experience in Information Security, AppSec, or Cloud Security.
• 3–5 years of focused experience in API security.
• Proficiency with OAuth, OpenID Connect, JWT, mTLS, and HMAC signatures.
• Hands-on experience with API gateway platforms and WAF configuration.
• Deep understanding of OWASP Top 10 (API and Web) vulnerabilities and remediation.
• Experience with cloud-native environments (AWS, GCP, or Azure) and container security (Docker, Kubernetes).
• Knowledge of DevSecOps practices, security automation, and CI/CD tools.
• Scripting proficiency in Python, Shell, or JavaScript.
• Any Graduate degree.

Preferred Skills

• Security certifications such as CISSP, CSSLP, GWAPT, or APIsec.
• Experience with runtime protection, API abuse detection, zero-day threat analysis, or SIEM/SOAR tools.

Key Skills

Education

Any Graduate