Sr External Web Application & API Security Engineer

The Senior Engineer, External Web Application & API Security is a hands-on technical lead responsible for enterprise API security and web application protection.

You will:

• Lead the engineering and operationalization of API discovery, posture management, and runtime protection capabilities across cloud, on-premises, and partner environments.
• Design, operate, and tune WAF and edge security controls for high-availability digital services.
• Assess and reduce API risk related to authorization failures, authentication weaknesses, excessive data exposure, business logic abuse, injection, automation, and other OWASP API Security Top 10 risks.
• Design and tune WAF, rate-limiting, bot management, DDoS, and edge security controls for applications and APIs, with a strong focus on accuracy, resiliency, and low false-positive rates.
• Automate repeatable security workflows and embed validation into CI/CD and DevSecOps processes.

This role reports into the Senior Manager, Application & API Security (E-WAAP) and will provide coaching and technical direction to Engineers and Analysts as we in-source capabilities from our managed services provider.

API Security Engineering and Architecture

• Lead API discovery, inventory, classification, and ownership mapping across external, internal, partner, and cloud-hosted APIs, including identification of shadow, zombie, and unmanaged APIs.
• Operate and improve enterprise API security capabilities for posture management, runtime detection, attacker behavior analysis, and risk prioritization.
• Assess REST, GraphQL, SOAP, gRPC, and event-driven APIs for OWASP API Security Top 10 risks, authentication and authorization weaknesses, excessive data exposure, schema and input-validation gaps, rate-control issues, and differences between documented and observed behavior.
• Partner with API owners and engineering teams to prioritize findings and implement practical remediation or compensating controls.
• Develop reusable API security patterns and reference architectures for customer-facing, mobile, partner, microservice, and third-party integrations.

Runtime API Protection and Security Operations

• Analyze API telemetry, tune behavioral detections, and lead incident investigation and containment for credential abuse, token misuse, scraping, enumeration, account takeover, authorization bypass, data exfiltration, and business logic abuse.
• Integrate API security events and findings with SIEM, SOAR, ticketing, and case-management workflows to support centralized monitoring, response, and remediation tracking.
• Define and monitor API coverage, ownership, unmanaged API risk, critical findings, remediation aging, attack volume, alert fidelity, and response-time metrics.

WAF and Edge Application Protection

• Design, onboard, and tune WAF, rate-limiting, bot-management, DDoS, and edge controls for applications and APIs, including OWASP protections, custom rules, virtual patching, and narrowly scoped exceptions.

Automation, DevSecOps, and Platform Engineering

• Automate API and WAF security workflows using platform APIs, Terraform, scripting, and CI/CD pipelines, including configuration validation, policy promotion, alert routing, remediation tracking, rollback, and reporting.

Governance, Collaboration, and Technical Leadership

• Lead security design reviews.
• Maintain API and web application security standards and runbooks.
• Communicate risk and remediation priorities.
• Mentor engineers and analysts.
• Support high-severity incidents as required.

• Bachelor's degree in Computer Science, Engineering, Information Technology, Cybersecurity, or a related field, or equivalent practical experience.
• Five or more years of security engineering experience, including at least three years of hands-on API security across discovery, posture assessment, runtime monitoring, testing, architecture review, or control engineering.
• Strong knowledge of REST, GraphQL, API gateways, microservices, HTTP, TLS, JSON, OAuth 2.0, OpenID Connect, JWT, API keys, mutual TLS, service identities, authorization, and common API abuse patterns.
• Hands-on experience with enterprise API security and WAF platforms.
• Experience analyzing security telemetry, investigating attacks, reducing false positives, scripting in a common language, and integrating security platforms with SIEM, SOAR, ticketing, or workflow automation tools.
• Experience with at least one major cloud platform (AWS, Microsoft Azure, or Google Cloud Platform), including API gateway, identity, logging, and load-balancing services.
• Strong written and verbal communication skills, with the ability to explain technical risk and remediation to both engineering and non-technical stakeholders.

Preferred Qualifications

• Hands-on Akamai API Security and App & API Protector experience.
• OpenAPI or GraphQL schema analysis.
• Terraform and Git-based deployment workflows.
• Experience supporting global, high-volume digital platforms.