Api Security

Api Security Engineer Jobs

7 jobs found

1d ago

Staff Product Security Engineer, Reviews

Okta San Francisco, CA

San Francisco, CA

1d ago

$180k - $248k/yr Full time Ai Security Api Security Application Security

Apply Now

Job Description

The Staff Product Security Engineer will conduct security reviews, guide secure development practices, and handle externally reported vulnerabilities across Okta's products, including code reviews, penetration testing, and architectural security assessments.

Responsibilities

Conduct security reviews including design reviews, threat modeling, and penetration testing for new features and major changes.
Perform manual secure code reviews across multiple programming languages.
Identify and mitigate security vulnerabilities, providing clear guidance to engineering teams.
Lead product security incidents, assess risks, and drive remediation efforts.
Develop security tools and automation to improve vulnerability detection and assessment.
Mentor junior engineers and provide guidance to non-security staff on secure development practices.
Represent Okta externally through security research, conference talks, and publications.

Requirements

Expertise in identifying OWASP Top 10 and CWE Top 25 vulnerabilities through manual code review.
Strong experience in penetration testing and secure development practices.
Deep technical background in assessing Large Language Models and securing AI integrated software architectures.
Proficiency in multiple programming languages, including Java, Go, Python, and C/C++.
Deep understanding of authentication and authorization protocols (OIDC, SAML, OAuth).
Strong communication skills to explain risks and remediation to developers and leadership.
Ability to automate security testing using large language models and scripting (Python, Bash, etc.).
Experience leading security incidents and risk assessments.

Technologies

Java
Go
Python
C/C++
OIDC
SAML
OAuth
Large Language Models (LLMs)
SAST
DAST
SCA
Fuzzing tools

Benefits

Supporting Your Well-Being
Driving Social Impact
Developing Talent and Fostering Connection + Community

The Okta Experience

Supporting Your Well-Being
Driving Social Impact
Developing Talent and Fostering Connection + Community

View full job page →

1d ago

Staff Application Security Engineer

Datadog New York, NY

New York, NY

1d ago

$244k - $305k/yr Full time Senior Ai Security Api Security

Apply Now

Job Description

Datadog is seeking a Staff Application Security Engineer to define the security direction for applications at scale, establish secure-by-default patterns, and drive the AppSec roadmap as the principal expert for cross-team security programs.

Responsibilities

Define and promote security standards and secure-by-default patterns as the AppSec subject matter expert.
Build scalable security tooling and automation, and implement robust security observability to provide meaningful signals for the threat-detection team.
Lead threat modeling and risk assessments for high‑risk features and platform changes.
Assess and mitigate security risks introduced by agentic development practices and AI powered product features in production.
Partner with engineering teams to prioritize remediation, define API security standards, and conduct secure code reviews.
Identify systemic security risks and lead end-to-end remediation across multiple teams.
Collaborate with Cloud & Infrastructure Security and other groups on cross-domain problems; serve as the AppSec point of contact for complex cross-domain issues.
Act as the AppSec subject matter expert across Datadog and provide guidance to engineering leadership on difficult security problems.
Invest in the growth and development of AppSec engineers through mentorship and structured programs.

Requirements

Software engineering background with hands-on code review experience; Go is preferred, with Python or Rust also acceptable.
Proven ability to elevate engineers through design reviews, mentorship, and thorough documentation.
Solid grounding in OWASP Top 10, web vulnerabilities (XSS, injection, access control, cryptography), SAST, and DAST.
Working knowledge of API security, including authentication flows, authorization patterns, and input validation at API boundaries.
Track record of leading threat modeling on complex, multi‑team systems and translating outcomes into architectural decisions.
Experience implementing secure-by-default frameworks and integrating security into core platforms with product managers and engineering teams.
Ability to translate business risk into security investment priorities and communicate tradeoffs to executive audiences.
Familiarity with software supply chain security, including dependency management, artifact integrity, and build pipeline trust.
Bias toward implementing solutions and driving adoption, not just surfacing findings.
Proven ability to secure buy-in from technical and non-technical stakeholders and clearly communicate tradeoffs to engineers, product managers, and leadership.
Maintains current knowledge of security best practices, emerging threats, and the tooling landscape.

Technologies

Go, Python, Rust

Benefits

New hire stock equity (RSUs) and employee stock purchase plan (ESPP).
Continuous professional development, product training, and defined career pathing.
Intradepartmental mentor and buddy program to support internal networking.
Inclusive culture with access to Datadog Community Guilds and employee resource groups.
Inclusion Talks and internal panel discussions.
Free global mental health benefits for employees and dependents age 6 and above.
Competitive global benefits package.

About Datadog

Datadog is a leading observability and security platform designed for the AI era. It provides unified visibility across applications, infrastructure, data, models, and security, using AI to detect and resolve issues before they impact customers. Trusted by Fortune 500 companies and fast-growing AI leaders worldwide, Datadog helps teams move faster with clarity and confidence. Learn more about Datadog Life.

Equal Opportunity at Datadog

Datadog is committed to equal employment opportunity for all applicants regardless of race, color, ancestry, religion, sex, national origin, sexual orientation, age, citizenship, marital status, disability, gender identity, veteran status, or other characteristics protected by law. Qualified applicants with criminal histories will be considered in accordance with applicable laws. See our Candidate Legal Notices for details.

Privacy and AI Guidelines

Information submitted during the application process will be processed in line with Datadog's Applicant and Candidate Privacy Notice. For details on our AI policy, refer to the Interviewing at Datadog AI Guidelines.

View full job page →

2d ago

Staff Security Engineer, PEG Security Engineering (Information Security, Architecture and Engineering)

Bain & Co. Chicago, IL

Chicago, IL

2d ago

$141k - $177k/yr Full time Senior Api Security Azure

Apply Now

Job Description

Bain & Co offers a collaborative, impact-driven environment with a strong focus on practical security outcomes. Employees enjoy comprehensive benefits, generous paid time off, and a path that blends rigorous security work with fast, delivery-focused engineering. This role is based in Chicago, IL with hybrid work options.

As a Staff Security Engineer in the PEG Security Engineering team, you will secure Bain’s PE platform estate on Azure AKS, embed security into the development lifecycle, define security standards and controls, and lead platform security engineering and incident response across cross-functional teams.

Responsibilities

Own and operate the platform's security posture end to end across core controls including HashiCorp Vault or Azure Key Vault, Istio mTLS, Cilium network policy, Pod Security Standards, and OPA/Gatekeeper policies.
Design and implement zero trust security architecture across the estate with defense in depth, least privilege, and explicit security boundary design.
Perform lightweight threat modelling (STRIDE) for new services and major features prior to implementation; document risks, mitigations, and residual risk decisions.
Manage supply chain security controls such as container image scanning, image signing, SBOM generation, and dependency vulnerability management.
Define and enforce identity and access controls including SAML/OIDC integration patterns, JWT/OAuth concepts, and enterprise IdP guidance (Okta/Entra).
Define and maintain data classification controls and enforce them at the platform layer through governed access patterns, masking/tokenization, and API-layer enforcement.
Own runtime detection controls by operating Falco rules and escalation pathways; integrate signals with the central SIEM and minimize alert noise while preserving actionable insight.
Lead security incident response for the platform, driving containment, remediation, and post-incident reviews with clear follow-up actions.
Conduct regular security reviews of the AI layer, including Agent Gateway egress controls, prompt injection risks, PII handling, and data exfiltration controls for model interactions.
Maintain security runbooks and execute quarterly internal security reviews across teams; ensure controls are tested, auditable, and actively maintained.
Set and enforce security standards, build controls as code, and partner with Platform Engineering, Data Platform, Product Engineering, and the Agent / AI squad to reduce risk while enabling rapid delivery.

Requirements

Bachelor’s degree in Computer Science, Engineering, Information Systems, Cybersecurity, or a related field, or equivalent practical experience.
6+ years of experience in security engineering, infrastructure security, SRE/DevOps with a security focus, or platform engineering roles with hands-on security ownership.
Proven experience implementing and operating security controls in Kubernetes-based production environments (policy enforcement, workload isolation, network controls, and runtime detection).
Experience designing and operating secrets management and identity/access controls (HashiCorp Vault and/or Azure Key Vault, PKI, OIDC/SAML patterns, enterprise IdP integration).
Experience implementing supply chain security practices (scanning, signing, SBOMs, dependency management) and integrating controls into CI/CD pipelines.
Experience leading or materially contributing to security incident response, including post-incident review and remediation planning.
Demonstrated ability to work cross-functionally as an enabling partner, raising security standards without unnecessarily blocking delivery.

Technologies

HashiCorp Vault, Azure Key Vault
Istio, Cilium, Pod Security Standards, OPA, Gatekeeper
Falco, Kubernetes, AKS
SAML 2.0, OIDC, JWT, OAuth
Okta, Entra, Azure AD
Kyverno, Rego, Trivy, Cosign, Sigstore, Syft, Dependabot, Renovate
Python, Bash

Benefits

Bain pays 100% individual employee premiums for medical, dental and vision programs
Generous paid time off, including parental leave, sick leave and paid holidays
Fully vested 401(k) company contribution
Paid Life and Long-Term Disability insurance
Annual fitness reimbursements

Compensation and location

Location: Chicago, IL (hybrid)

Salary: USD 141,000 - 176,750 per year

Compensation by location

Chicago, IL: $141,000 - $169,250
Boston, MA: $147,250 - $176,750

View full job page →

8d ago

Lead Application Security Engineer

Carter's Atlanta, GA

Atlanta, GA

8d ago

Full time Senior Api Security Application Security

Apply Now

Job Description

What you get

Join an on-site team in Atlanta where you will shape the enterprise AppSec program. This senior technical leadership role lets you own the strategy, standards, and tooling for application security while getting hands-on with AI security initiatives. You will report to the Sr. Director, IT Security, and collaborate closely with engineering leaders to embed security into system design, SDLC processes, and platform decisions. Expect a role centered on impact, collaboration, and measurable risk reduction, with opportunities to build AI powered security tooling and governance around AI/ML integrations.

Responsibilities

Define and own the enterprise AppSec architecture, standards, and secure-by-default patterns across the organization.
Establish and evolve the AppSec tooling strategy, evaluate vendors, and drive adoption across engineering teams.
Lead threat modeling sessions for critical applications and new product features.
Serve as the final technical authority on AppSec decisions, including security design reviews and architecture signoffs.
Oversee advanced secure code reviews, SAST/DAST assessments, and manual penetration testing across web, mobile, and API surfaces.
Own API security standards for REST and GraphQL, enforcing OWASP API Top 10 controls and authentication/authorization design patterns.
Drive vulnerability triage, risk prioritization, and remediation accountability across development teams at scale.
Own the DevSecOps toolchain by designing, deploying, and maturing security gates within CI/CD pipelines.
Partner with engineering leadership to embed security into system design, SDLC processes, and platform decisions.
Develop and monitor AppSec metrics, dashboards, and KPIs to demonstrate program maturity and risk reduction.
Hands-on development of AI powered security tooling and automation, including AI assisted code review, threat detection, and vulnerability triage.
Secure AI/ML integrations by assessing prompt injection, data leakage, model supply chain, and third-party AI service risks.
Develop and enforce AI governance policies, including acceptable use, security review gates, and risk acceptance criteria for AI adoption.
Represent the IT Security team in architecture reviews, cross functional planning, and executive risk reporting.
Maintain security policy and standards documentation related to AppSec, AI use, and API governance.
Lead AppSec representation in PCI-DSS, NIST, and OWASP audits, including evidence collection and coordination.

Requirements

5+ years of experience in application security, software engineering, or secure code review.
Strong proficiency in one or more programming languages (Python, Java, JavaScript, or Go) with capability for in-depth code review and threat modeling.
Experience with SAST/DAST tooling (Snyk, SonarQube, Semgrep, Checkmarx, Burp Suite, OWASP ZAP) and ownership of AppSec program design.
Proven communication and presentation skills across multiple stakeholder levels.
Ability to meet deadlines and collaborate with management across diverse disciplines.
Proven track record of collaboration with cross functional teams.
Willingness to perform on-call duties during off hours and holidays.
Adaptable and flexible attitude toward changing business needs.
Bachelor's degree in computer science or a related field.
Experience leading red team, penetration testing, or adversarial simulations.
Experience designing and scaling security observability pipelines, including log analysis and application telemetry.
Working knowledge of PCI-DSS, NIST, OWASP, and other regulatory frameworks; experience representing security in audits and compliance reviews.
Proven ability to secure cloud native or hybrid cloud environments (AWS, Azure, or GCP).
Hands-on experience building, deploying, or integrating AI/ML powered tools and the ability to assess and govern their security posture (prompt injection, data leakage, model supply chain risks).
Demonstrated ability to define and enforce security standards across engineering organizations and to own a security capability or domain.
Certifications such as Security+, ISC2 CC, CompTIA A+, CompTIA Network+, SSCP, CCT, GWEB, CSSLP, CEH, or OSCP.

Technologies

Python, Java, JavaScript, Go
Snyk, SonarQube, Semgrep, Checkmarx, Burp Suite, OWASP ZAP
REST, GraphQL
AWS, Azure, GCP
PCI-DSS, NIST, OWASP

Travel

Open to travel between Carter's offices as needed.

View full job page →

10d ago

Product Security Engineer

Adobe Lehi, UT

Lehi, UT

10d ago

$67 - $84/hr Contract Api Security Application Security Cloud Platforms

Apply Now

Job Description

Adobe, in partnership with NextDeavor, offers a contract Product Security Engineer role on-site in Lehi, Utah. This position centers on triaging and validating external vulnerability reports, coordinating remediation with engineering teams, and contributing to the ongoing maturation of the bug bounty program. You will join a security-focused environment that values thorough analysis, clear communication, and cross-functional collaboration, with a competitive hourly rate of $67.61 to $84.51.

Responsibilities

Review vulnerability submissions from the bug bounty platform, determining validity, potential impact, and scope.
Apply CVSS v3.1 scores and severity levels according to internal guidelines and industry standards.
Reproduce proof-of-concept exploits across web, API, and mobile surfaces to validate findings.
Engage with external researchers to seek clarifications, share status updates, and manage expectations.
Coordinate remediation with product engineering teams for confirmed vulnerabilities.
Identify duplicates, out-of-scope, or informational reports and close them with clear explanations.
Contribute to internal documentation, triage runbooks, and severity calibration guidelines.
Flag systemic or critical findings to the Bug Bounty team for escalation.

Requirements

At least three years of experience in application security, penetration testing, or a bug bounty/vulnerability disclosure role.
Strong understanding of CVSS v3.1 and experience applying it to real-world vulnerabilities.
Proficiency with common web vulnerability classes such as XSS, SQL injection, SSRF, IDOR, authentication flaws, and business logic issues.
Ability to reproduce and validate PoC exploits using Burp Suite, browser DevTools, curl, and custom scripts.
Familiarity with bug bounty platforms like HackerOne and Bugcrowd and with responsible disclosure processes.
Solid written communication skills for clear, constructive responses to external researchers.
Familiarity with attacker techniques targeting LLM systems and generative AI products.
Knowledge of OWASP Top 10 vulnerabilities and mitigation techniques.

Technologies

Burp Suite
Browser DevTools
curl
HackerOne
Bugcrowd
AWS
Azure
GCP

Benefits

Health insurance
Vision insurance
Dental insurance
401(k)
Paid sick leave

To be considered, please submit your resume.

View full job page →

13d ago

Application Security Engineer

Wolfe, LLC Pittsburgh, PA

Pittsburgh, PA

13d ago

$110k - $120k/yr Full time Api Security Application Security Bot Management

Apply Now

Job Description

Application Security Engineer role with Wolfe, LLC in Pittsburgh, PA, onsite five days per week.

Responsibilities

Conduct code reviews, SAST/DAST testing, basic penetration testing, and lightweight threat modeling, collaborating with developers to remediate vulnerabilities across application code, libraries, containers, and infrastructure as code.
Integrate and operate automated security tooling (for example Snyk, SemGrep, Cycode) within CI/CD pipelines across code repositories such as GitHub, GitLab, Jenkins, and AWS DevOps, and assist with triage and reporting of findings.
Oversee vulnerability management programs, scanning tools, and the enterprise Bug Bounty program, tracking and prioritizing remediation against defined SLAs.
Support Bot Management, Web Application Firewall, secrets management, and API security controls across Wolfe's applications.
Promote secure coding standards aligned with OWASP and SANS CWE Top 25, and contribute to measuring DevSecOps maturity using DSOMM or BSIMM.
Collaborate with developers, security operations, product management, and incident response teams, sharing secure-coding and vulnerability-management practices while expanding personal expertise.

Requirements

Minimum 2 years of experience in application security, DevSecOps, or security-exposed software development, including developers transitioning into security roles; Bachelor's degree in Information Security, Cybersecurity, Computer Science, or a related field (equivalent experience accepted).
Strong coding background with working knowledge of secure coding principles (OWASP Top 10, SANS CWE Top 25).
Hands-on exposure to CI/CD pipelines (GitHub, GitLab, Jenkins, AWS DevOps) and interest in embedding security tooling into those workflows.
Excellent verbal and written communication skills, capable of explaining security concepts to technical and non-technical teammates.
Willingness to learn enterprise security tooling (vulnerability scanners, Bot Management, SAST/DAST/SCA) and maturity frameworks such as DSOMM or BSIMM; prior experience is a plus but not required.
No mandatory certifications; familiarity with CISSP, OSCP, GCSA, AWS Security Specialty, or CSSLP is a plus, and Wolfe will support pursuing them.

Technologies

Snyk
SemGrep
Cycode
GitHub
GitLab
Jenkins
AWS DevOps
DSOMM
BSIMM
OWASP Top 10
SANS CWE Top 25
SAST
DAST
SCA
Bot Management
WAF

Benefits

Restricted Stock Units (RSUs)
Profit Share and/or Incentive Bonus
Medical, Prescription, Vision, and Dental insurance for employees and dependents (Wolfe pays 80% of the premium)
Short-Term Disability Insurance (Wolfe pays 100% of the premium)
Voluntary Long-Term Disability Insurance, Life Insurance, Critical Illness Insurance, Accident Insurance, and Hospital Indemnity coverage
PTO (vacation and sick time)
Corporate Holidays and Floating Holidays
401(k)
Employee recognition program
Charitable donation to a charity of your choice yearly
Employee referral bonus
Tuition reimbursement
Internal training and information sessions
Family Picnic, Holiday Party, and other outings
Internal Culture Club

Impact Statement

Update the existing Application Security Strategy and improve monitoring and KPI reporting
Deliver a significant improvement to at least one automated security tool in the production CI/CD pipeline and establish a documented triage workflow
Drive additional Bug Bounty submissions and strengthen bot management protections before the end of Q3
Provide product and technology advisement and testing for new application and AI functionality
Develop and plan a targeted Application and AI development training program

View full job page →

14d ago

Sr Lead Security Engineer

JPMorganChase Plano, TX

Plano, TX

14d ago

$171k - $260k/yr Full time Senior Ai Security API

Apply Now

Job Description

Join JPMorganChase in Plano, TX, where a benefits-rich environment, on-site wellness support, and a culture of collaboration empower you to make a meaningful impact in cybersecurity. Enjoy comprehensive health care coverage, on-site health and wellness centers, a retirement savings plan, backup childcare, tuition reimbursement, mental health support, and financial coaching as part of a thoughtful rewards program designed to support you and your family.

Benefits

Comprehensive health care coverage
On-site health and wellness centers
Retirement savings plan
Backup childcare
Tuition reimbursement
Mental health support
Financial coaching

Responsibilities

Provide ongoing technical guidance to support the business and its technical teams, contractors, and vendors
Develop secure, high-quality production code and review or debug code written by others
Clarify security requirements across multiple networks to enable multi-level security aligned with organizational needs
Collaborate with stakeholders and senior leaders to propose business modifications during periods of vulnerability
Serve as a function-wide subject matter expert in one or more focus areas; influence peers and project decision-makers to adopt leading-edge technologies
Apply reuse-first and AI-assisted practices within SDLC and toolchains to strengthen security testing, traceability, and alignment with resiliency and security expectations
Leverage enterprise-authorized AI capabilities to accelerate security risk analysis and documentation, synthesizing threat assessments with proper validation and data handling

Requirements

Formal training or certification with 5+ years of experience in cloud service development and integration; proficient in OAuth, SAML, API security, and identity federation; experience building high-performance API-first services and integrating tooling
Ability to plan, design, and implement enterprise security solutions with hands-on experience delivering system design, application development, testing, and operational stability
Advanced proficiency in one or more programming languages: C#, C++, Go, Python, Java
Extensive knowledge of software development processes with deep expertise in cloud, artificial intelligence, machine learning, or mobile domains; solid experience with threat modeling, vulnerability discovery, and penetration testing
Capability to tackle design and functionality problems independently with minimal oversight; strong knowledge of HTTP/HTTPS, SSL/TLS inspection, traffic interception, and API gateway patterns
Experience using enterprise-authorized AI capabilities to support security engineering workflows with rigorous validation and awareness of data sensitivity
Ability to review and validate AI-assisted security recommendations before adoption, ensuring alignment with security, resiliency, and auditability expectations

Technologies

OAuth
SAML
API security
Identity federation
C#, C++, Go, Python, Java
HTTP/HTTPS, SSL/TLS
API gateway patterns
API Gateway Development, Custom proxy
VPM development, SSE, CASB, SIEM
Cloud, Artificial intelligence, Machine learning, Mobile
Enterprise-authorized AI capabilities, AI-assisted security workflows

About JPMorganChase

JPMorgan Chase & Co is a long established financial institution delivering innovative solutions to millions of consumers, small businesses, and a wide range of corporate, institutional, and government clients under the J.P. Morgan and Chase brands. With a history spanning more than 200 years, the firm leads in investment banking, consumer and business banking, commercial banking, financial transaction processing, and asset management. The company offers a competitive total rewards package, including base salary determined by role, experience, and location, with eligibility for incentive compensation. A focus on diversity and inclusion informs all operations, and JPMorgan Chase is an Equal Opportunity Employer, including Disability/Veterans.

About the team

Our Corporate Functions span finance and risk, human resources, and marketing, forming an essential backbone that helps ensure the success of our businesses, clients, customers, and employees.

View full job page →

Api Security Engineer Jobs

Staff Product Security Engineer, Reviews

Staff Application Security Engineer

Staff Security Engineer, PEG Security Engineering (Information Security, Architecture and Engineering)

Lead Application Security Engineer

Product Security Engineer

Application Security Engineer

Sr Lead Security Engineer

Get Api Security Engineer Jobs alerts