Senior API Security Engineer

Key Responsibilities

API Logic Security

Hunt for Business Logic vulnerabilities (BOLA/IDOR, Mass

Assignment) that traditional firewalls miss.

Authentication & Authorization

Design and validate OAuth2, OIDC, and JWT

implementations to ensure users can only access their own data.

Attack Simulation

Script automated attacks against the API Gateway to test rate limiting

and fraud detection rules.

Gateway Hardening

Work with the Platform team to configure the API Gateway (Kong,

or Azure API Gateway) for maximum security.

Auth & Partner Integration

Deliver new security design patterns and components for

authentication, authorization, SSO, MFA, and Partner security. Standardize how we

consume external APIs (Open Banking) and how we secure our own exposed endpoints.

Technical Requirements

• Strong scripting skills (Python) to automate API attacks.
• Expertise in REST and GraphQL security.
• Deep knowledge of OAuth 2.0 and OpenID Connect (OIDC) flows.
• Experience with API Security tools (Postman, Burp Suite, 42Crunch).