Security Engineer

• Build relationships with developers and stakeholders to incorporate security principles into engineering design and deployments.
• Define and maintain API security standards, guidelines, and best practices.
• Work with engineering and product teams to incorporate security requirements into API design, including authentication, authorization, rate limiting, encryption, and data validation.
• Assess architecture diagrams and integration flows for security risks and propose mitigation strategies.
• Perform manual and automated security testing of APIs (e.g., fuzzing, penetration testing, misuse-case reviews).
• Identify & validate vulnerabilities, i.e. injection flaws, broken authentication, access control issues, insecure deserialization, and misconfigurations.
• Ensure integration of security testing tools into CI/CD pipelines (SAST, DAST, API-specific scanners).
• Implement API-level logging, anomaly detection, runtime protections, and threat monitoring.
• Investigate and respond to API-related security incidents, breaches, or suspicious activity.
• Collaborate with SOC, DevSecOps, and engineering teams to develop alerting and mitigation processes.
• Develop and enforce API security policies aligned with organizational risk management.
• Conduct regular security reviews and maintain documentation for audits and assessments.
• Provide guidance to developers on secure API design and coding practices.
• Deliver training sessions, code review feedback, and threat-modeling workshops.
• Document security findings, outline remediation options and oversee mitigation.
• Support the rollout and adoption of API gateways, identity platforms, and secure coding tools.
• Focus on automation to aid in efficiencies with both testing and remediation of findings.
• Attend and participate in product meetings addressing security requirements for new and existing products.
• Build services and tools to enable developers and engineers to easily use security components
• Support the ability to “shift left” and incorporate security early on and throughout the development lifecycle.
• Communicate vulnerability results to both technical and non-technical users, through influential messaging.
• Regularly research and learn new tactics, techniques and procedures (TTPs) in public and closed forums, and work with colleagues to assess risk and implement/validate controls as necessary through the CI/CD pipeline.
• Enrich DevSecOps architecture with security standards and best practices.
• Partner with teams to define key performance indicators (KPIs) and metrics across business units.
• Ensure regulatory compliance (e.g., PCI, HIPAA, HITRUST, NIST CSF) through effective security controls and processes.
• Other duties as assigned.

API Security Engineer

Program Security Specialist III

Information Security Engineer

Security Consultant

Control System Cybersecurity Project Manager – Remote, Travel