Senior API Security Engineer

About this role

<p>Key Responsibilities:&nbsp;<br>● API Logic Security: Hunt for Business Logic vulnerabilities (BOLA/IDOR, Mass&nbsp;<br>Assignment) that traditional firewalls miss.&nbsp;<br>● Authentication &amp; Authorization: Design and validate OAuth2, OIDC, and JWT&nbsp;<br>implementations to ensure users can only access their own data.&nbsp;<br>● Attack Simulation: Script automated attacks against the API Gateway to test rate limiting&nbsp;<br>and fraud detection rules.&nbsp;<br>● Gateway Hardening: Work with the Platform team to configure the API Gateway (Kong,&nbsp;<br>or Azure API Gateway) for maximum security.&nbsp;<br>● Auth &amp; Partner Integration: Deliver new security design patterns and components for&nbsp;<br>authentication, authorization, SSO, MFA, and Partner security. Standardize how we&nbsp;<br>consume external APIs (Open Banking) and how we secure our own exposed endpoints.&nbsp;</p> <p>Technical Requirements:&nbsp;<br>● Strong scripting skills (Python) to automate API attacks.&nbsp;<br>● Expertise in REST and GraphQL security.&nbsp;<br>● Deep knowledge of OAuth 2.0 and OpenID Connect (OIDC) flows.&nbsp;<br>● Experience with API Security tools (Postman, Burp Suite, 42Crunch).</p>

View the original posting ↗