Senior API Security Engineer

Key Responsibilities

• ● API Logic Security: Hunt for Business Logic vulnerabilities (BOLA/IDOR, Mass
• Assignment) that traditional firewalls miss.
• ● Authentication & Authorization: Design and validate OAuth2, OIDC, and JWT
• implementations to ensure users can only access their own data.
• ● Attack Simulation: Script automated attacks against the API Gateway to test rate limiting
• and fraud detection rules.
• ● Gateway Hardening: Work with the Platform team to configure the API Gateway (Kong,
• or Azure API Gateway) for maximum security.
• ● Auth & Partner Integration: Deliver new security design patterns and components for
• authentication, authorization, SSO, MFA, and Partner security. Standardize how we
• consume external APIs (Open Banking) and how we secure our own exposed endpoints.

Technical Requirements

• ● Strong scripting skills (Python) to automate API attacks.
• ● Expertise in REST and GraphQL security.
• ● Deep knowledge of OAuth 2.0 and OpenID Connect (OIDC) flows.
• ● Experience with API Security tools (Postman, Burp Suite, 42Crunch).