Description
This role sits at the core of Product and AI Security engineering, leveraging security expertise to resolve complex security issues, partner with teams to drive security initiatives, and apply analytical skills to solve security challenges.
Essential Responsibilities:
- Leverage specialized security expertise to identify and resolve complex security issues, recommending best practices and determining new approaches that have an impact on broader security operations.
- Partner across teams and key stakeholders to drive security initiatives, leading and solutioning complex projects and programs to strengthen overall security posture.
- Apply advanced analytical skills and sound judgment to solve security challenges, considering diverse perspectives and innovative solutions.
- Directly contribute to improvements within the security domain and occasionally beyond, ensuring decisions lead to meaningful enhancements in security practices.
- Leverage relationships across teams, both within and outside of security, to influence initiatives and integrate feedback into security processes.
Additional Responsibilities & Preferred Qualifications:
- Build the end-state API security capability plane, consolidating today's separate API security lint, gateway traffic visibility, shadow-API detection, and schema security checks into a single, coherent capability.
- Take the pre-release API security gate from draft architecture decision to a shipped control, working with the Staff Engineer who owns enforcement architecture.
- Own the dynamic application security testing (DAST) tooling strategy end to end, completing the current tool evaluation into a production migration decision, and executing it.
- Extend API security capability into two domains identified as organizational blind spots - pipeline access & execution control, and systemic artifact consumption verification.
- Be a force multiplier, mentoring engineers across the merged team, unblocking stuck initiatives, and driving delivery and innovation.
Requirements:
- 5+ years relevant experience and a Bachelor’s degree OR Any equivalent combination of education and experience.
- Software Engineering: 5+ years building production software with demonstrated staff-level ownership of a platform or system end-to-end, with hands-on coding experience in Python or Go.
- API Security Engineering: Deep, hands-on expertise in API architecture, authZ/authN, and API gateway or service-mesh internals.
- AI Knowledge: Working knowledge of how AI and agentic traffic is changing the API threat model.
- Working fluency in policy-as-code approaches to security enforcement and CI/CD security gating.
- Practical understanding of DAST/SAST tooling internals.
- Security fundamentals across product, cloud, and vulnerability management.
- Deep knowledge of the OWASP API Security Top 10 and common API abuse patterns.
- Hands-on experience with API traffic-protection mechanisms.
- Working knowledge of API discovery and inventory practices.