Api Security

Api Security Cybersecurity Jobs

27 jobs found

Today

Senior Application Security Specialist

Wintrust Financial Corporation Chicago, IL

Chicago, IL

Today

$117k - $158k/yr Full time Senior Ai Security Api Security

Apply Now

Job Description

Wintrust Financial Corporation offers a security-focused environment where application protection, secure engineering practices, and continuous improvement are built into the SDLC. In this onsite Chicago role, you will help reduce risk across enterprise applications, APIs, and SaaS platforms while working with modern security tooling and AI-assisted engineering workflows. The role also includes benefits designed to support health, financial wellness, family needs, and professional growth.

What you’ll do

Lead application threat modeling, security architecture reviews, and manual code reviews, defining requirements for authentication, authorization, data protection, and secure design across web applications, APIs, and cloud-hosted services.
Implement and tune SAST and SCA with Checkmarx, and integrate DAST, secrets scanning, and risk-based security gates into CI/CD pipelines.
Support API discovery, posture assessment, security testing, and runtime monitoring using an enterprise API security toolset, investigating issues such as sensitive data exposure, broken authorization, and API abuse with application owners and security operations.
Design and implement AI-assisted SDLC workflows for code review, unit and integration test generation, security testing, vulnerability triage, and remediation, including human review and validation of AI-generated code and tests.
Drive vulnerability remediation using exploitability, exposure, and business impact, validate fixes, support incident response, and track testing coverage, remediation times, and recurring defects for risk and compliance reporting.
Coach developers on secure coding and maintain reusable security patterns and guidance, while evaluating AI workflow adoption, finding quality, test coverage, and time savings to improve both security and developer productivity.

What you’ll bring

5-7 years of relevant experience (minimum 5 years).
Bachelor’s degree or equivalent; Computer Science or Cybersecurity preferred.
Preferred: application security, cybersecurity, and/or Artificial Intelligence certifications.
Experience in application security, secure development, or DevSecOps, including threat modeling, manual code review, API testing, vulnerability remediation, and Git-based CI/CD integration.
Ability to review Java, Apex, and/or Python code and build automation.
Knowledge of OWASP Top 10, API Security Top 10, ASVS, authentication, authorization, OAuth/OIDC, and secrets management.

Tools and technologies

Checkmarx
Akamai API Security
OWASP Top 10, API Security Top 10, ASVS
OAuth/OIDC
SAST, SCA, DAST
Git-based CI/CD
Java, Apex, Python

Benefits

Medical Insurance
Dental
Vision
Life insurance
Accidental death and dismemberment
Short-term and long term Disability Insurance
Parental Leave
Employee Assistance Program (EAP)
Traditional and Roth 401(k) with company match
Flexible Spending Account (FSA)
Employee Stock Purchase Plan at 5% discount
Critical Illness Insurance
Accident Insurance
Transportation and Commuting Benefits
Banking Benefits
Pet Insurance
Tuition reimbursement

Preferred experience

Experience implementing AI-assisted SDLC workflows for code review, test generation, security testing, and remediation, with measurable results.
Ability to apply human review, validate AI-generated code and tests, and protect sensitive data.
Experience with Checkmarx, Akamai API Security, or comparable tools.
Experience communicating risk and supporting regulated financial services.

Compensation

The estimated salary range for this role is $117,000 - $158,000 per year, along with eligibility to earn an annual bonus. Actual salaries may vary based on qualifications, skills, and experience.

View full job page →

1d ago

AppSec Sales Engineer

Harness.io Dallas, TX 🇺🇸 Remote

Dallas, TX

1d ago

$182k - $218k/yr Full time Ai Security Api Security Application Security

Apply Now

Job Description

Work where DevSecOps meets real-world application security: Harness’s AI-Native DevSecOps platform is built to help teams secure software throughout the SDLC, including modern API and AI workflows. This AppSec Sales Engineer role bridges sales and engineering to explain the platform clearly to executive, business, and technical audiences, while supporting technology evaluations and adoption decisions.

Benefits that support your day-to-day and your growth: Harness offers a competitive salary, comprehensive healthcare benefits, a Flexible Spending Account (FSA), a flexible work schedule, and Flexible Time Off with Parental Leave. You’ll also have access to an Employee Assistance Program (EAP), monthly internet and phone reimbursement, and regular social and team building events (monthly, quarterly, and annual).

Pay transparency: $182,000 - $218,000 USD per year.

Responsibilities

Deliver platform presentations and demos with a focus on Application Security Testing and Runtime Protection within the broader DevSecOps landscape.
Educate customers on the value of the Harness AI-Native DevSecOps platform, including AppSec and API/AI Security capabilities such as SCA, SAST, DAST, and runtime protection.
Translate business security and compliance challenges into technical solutions aligned to an end-to-end DevSecOps pipeline.
Lead complex technical engagements, including workshops and POVs, to demonstrate how Harness helps secure the SDLC from code to operation, including API and AI workflows.

Requirements

Own product demo delivery that shows how customers can eliminate security debt and mitigate emerging API and AI risks.
Experience as a Pre-Sales Engineer supporting SaaS/software sales in the DevSecOps or Cybersecurity domain, or a strong practitioner background with familiarity in software evaluation and buying processes.
Hands-on experience with modern application security practices and tools such as API Security, AI Security, SAST, DAST, SCA, or comparable technologies.
Comfort with cloud-native application security and the security risks tied to integrating GenAI.
Ability to stay current on developments in AI security, software supply chain security, and evolving threat landscapes.
Capability to communicate complex customer security requirements and translate feature requests to Engineering.
Ability and willingness to travel occasionally for customer engagements, internal meetings, or trade shows/conferences, including short-notice travel when needed.

Tech areas

Application Security Testing, Runtime Protection, SCA, SAST, DAST, API Security, AI Security, GenAI

Location: Dallas, TX (remote)

Fraud warning: Harness has indicated there may be fraudulent recruiting attempts by people posing as representatives of Harness.

View full job page →

1d ago

Application Security and Penetration Testing Engineer

Agadia Systems Inc Parsippany, NJ

Parsippany, NJ

1d ago

$110k - $125k/yr Full time Api Security Application Security Cybersecurity Tools

Apply Now

Job Description

Agadia Systems Inc seeks an Application Security and Penetration Testing Engineer to strengthen enterprise web application and API security through automated and manual testing, validation, and remediation collaboration.

Responsibilities

Conduct security assessments of web applications, APIs, and supporting services using automated vulnerability scanning and DAST tools.
Perform manual penetration testing to uncover vulnerabilities that automated tooling may miss.
Test authentication, authorization, session management, and access controls, including role-based and business-logic enforcement.
Evaluate input validation, file handling, API behavior, and application business logic.
Identify and assess issues including broken access control, injection, cross-site scripting, insecure configurations, information exposure, and privilege escalation.
Validate scan results by eliminating false positives and determining exploitability and business impact for confirmed vulnerabilities.
Document findings with technical evidence, reproduction steps, severity, risk, business impact, and remediation recommendations.
Partner with development and architecture teams to review results and recommend practical fixes.
Retest remediated issues and formally confirm vulnerability closure.
Support secure design reviews, threat modeling, code reviews, and release-readiness assessments.
Help integrate application security testing into the software development lifecycle and CI/CD pipelines.
Maintain vulnerability status, remediation timelines, risk exceptions, and security assessment reports.
Support internal audits, customer security reviews, and external penetration-testing activities.
Provide application security guidance and knowledge-sharing for development and QA teams.
Stay current on emerging vulnerabilities, attack techniques, security tools, and application security best practices.

Requirements

Bachelor’s degree in Computer Science, Cybersecurity, Information Technology, or a related discipline (or equivalent professional experience).
5+ years of information security experience, including at least 3 years hands-on web application and API penetration testing.
Strong knowledge of OWASP Top 10, OWASP API Security Top 10, CWE, CVSS, and common application attack techniques.
Hands-on tool experience with Burp Suite Professional, OWASP ZAP, Invicti, or comparable DAST and penetration-testing platforms.
Ability to manually test authentication, authorization, session management, role-based access, API controls, and business-logic enforcement.
Capability to validate findings independently and differentiate exploitable vulnerabilities from false positives.
Knowledge of HTTP/HTTPS, REST APIs, cookies, tokens, browser security controls, and web application architecture.
Familiarity with secure coding practices and application security considerations for .NET and JavaScript-based applications.
Ability to communicate technical vulnerabilities, business impact, and remediation guidance to technical and leadership audiences.
Strong analytical, documentation, collaboration, and problem-solving skills.

Technologies

Burp Suite Professional
OWASP ZAP
Invicti
DAST
OWASP Top 10
OWASP API Security Top 10
CWE
CVSS
HTTP/HTTPS
REST APIs
.NET
JavaScript
Azure DevOps
GitHub
SAST
Software composition analysis
Dependency scanning
Secrets scanning
SonarQube
Threat modeling
OAuth 2.0
OpenID Connect
JWT

Preferred Qualifications

Experience securing healthcare applications or other systems handling sensitive or regulated information.
Knowledge of HIPAA, HITECH, HITRUST, SOC 2, NIST, and related security frameworks.
Experience with SAST, software composition analysis, dependency scanning, secrets scanning, and SonarQube.
Experience integrating security testing into Azure DevOps, GitHub, or similar CI/CD platforms.
Familiarity with threat modeling, secure architecture reviews, and source-code security reviews.
Experience testing single sign-on, OAuth 2.0, OpenID Connect, JWT, and other identity protocols.
Relevant certifications such as OSCP, OSWE, GWAPT, GPEN, CEH, or CISSP.

Benefits

Medical
Dental
Vision
Life Insurance
401
PTO

Success Measures

Earlier identification of application and API security risks.
Accurate findings with minimal false positives.
Clear, actionable remediation guidance for development teams.
Timely validation and closure of identified vulnerabilities.
Improved application security coverage throughout the development lifecycle.
Reduced dependence on periodic external penetration testing.

Key Competencies

Communicates effectively: provides timely information, gives and receives feedback productively, demonstrates strong oral and written communication.
Manages ambiguity: operates effectively when uncertain, adapts to changing business needs.
Manages complexity: handles complex, high-volume, sometimes contradictory information; strong organizational skills and attention to detail.
Ensures accountability: follows through on commitments; works independently as part of a small team.

Location: Parsippany-Troy Hills, NJ (onsite)

Salary: USD 110,000 - 125,000 per yearly

View full job page →

1d ago

Lead Application Security Engineer

Tiro Security Pasadena, CA

Pasadena, CA

1d ago

$120k - $180k/yr Full time Api Security Application Security Application Security Engineering

Apply Now

Job Description

Hands-on Lead Application Security Engineer role focused on strengthening DevSecOps and software assurance for a financial services organization in Pasadena.

Responsibilities

Harden development pipelines and evaluate the trustworthiness of internally developed and third-party applications
Coordinate penetration testing engagements and translate findings into actionable software risk decisions
Assess API security and incorporate threat intelligence to inform application security posture

Requirements

Proven application security or DevSecOps experience, including secure SDLC, threat modeling, and vulnerability remediation expertise
Hands-on experience with GitHub Advanced Security, including:
- Secret scanning
- Push protection
- Security automation within CI/CD pipelines
Practical experience with SAST, DAST, and code review using tools such as:
- CodeQL
- Dependabot
- OWASP ZAP
Experience evaluating third-party software, dependencies, or compiled binaries, including knowledge of software supply chain security

Key Technologies

GitHub Advanced Security
Secret scanning
Push protection
CI/CD pipelines
SAST and DAST
CodeQL
Dependabot
OWASP ZAP
Threat intelligence
API security

Location

Pasadena, CA (onsite)

Compensation

$120,000–$180,000 base per year

Work Authorization

US work authorization is required
Visa sponsorship is unavailable

Job Reference: 6145

Focus Areas

Influence how software is developed, assessed, and approved for enterprise use in partnership with engineering teams
Combine pipeline security, deeper application analysis, and continuous validation of application trust

View full job page →

8d ago

Principal Software Engineer — Application Security & AI Trust Architecture

Cisco Systems San Jose, CA

San Jose, CA

8d ago

$221k - $380k/yr Full time Ai Security Ai Trust Api Security

Apply Now

Job Description

In this Principal Software Engineering role at Cisco Systems, you will help set the security direction for software platforms and services, with a specific focus on application security and AI trust architecture. The work spans from defining security architecture and threat modeling to turning high-level strategy into secure-by-default, spec-driven engineering practices across cloud-to-box products.

This onsite position is based in San Jose, CA. The salary range for this role is USD 220,900 - 380,000 per year, and the position requires 15+ years of experience.

What you will do

Define and drive security architecture across software platforms and services.
Translate security strategy into hands-on engineering execution, ensuring products are secure from the cloud to the box.
Lead cross-functional initiatives and mentor engineering team members.
Engage with customers and leverage AI to improve the development lifecycle and threat prevention capabilities.
Collaborate with application teams to design secure-by-default software patterns.
Implement strict Model Context Protocol (MCP) access boundaries.
Enforce spec-driven security contracts across application interfaces.
Mitigate vulnerabilities unique to autonomous agent workflows, including prompt injection, indirect data exfiltration, and unauthorized tool invocation.
Design trust boundaries, sandboxing models, and execution guardrails for autonomous application agents and LLM tool-calling workflows.
Architect granular authentication, authorization, and least-privilege scoping for MCP servers, tool registries, and external integrations.
Mitigate emerging AI threat vectors such as OWASP Top 10 for LLMs, indirect prompt injection, tool hijacking, credential harvesting, and context leakage.
Establish spec-driven security standards across application contracts including OpenAPI, TypeSpec, and gRPC/Protobuf, embedding authentication schemes, data sanitization, and authorization scopes directly into machine-readable specs.
Implement automated security contract testing and static/dynamic schema validation to detect authorization bypasses, Broken Object Level Authorization (BOLA), and injection vulnerabilities before deployment.
Lead comprehensive architectural threat modeling for critical application tiers, distributed business logic, and multi-tenant data boundaries.
Create reusable, hardened software design patterns, cryptographic utilities, and session management frameworks for application engineering teams.
Architect and scale automated security gates in CI/CD pipelines including SAST, DAST, IAST, software composition analysis, container image signing, and SBOM tracking.
Define policy-as-code frameworks (for example, OPA/Rego and Cedar) to enforce deterministic security baselines across service deployments.
Act as the principal technical escalation point for complex application security architecture reviews and critical vulnerability disclosures.
Mentor senior engineers on defensive coding practices, modern API security standards, and zero-trust application design.

Requirements

Bachelor’s degree in Computer Science, Engineering, or a related technical field.
15+ years of experience in software engineering and application security architecture, including designing, securing, and operating distributed applications.
Experience with application security frameworks such as OWASP Top 10, OWASP API Top 10, CWE/SANS 25, or zero-trust application patterns.
Experience in identity and access governance including one or more of OAuth 2.0, OIDC, SAML, mTLS, SPIFFE/SPIRE, or fine-grained authorization models (RBAC, ABAC, ReBAC).
Experience in at least one backend language: Python, Go, TypeScript/Node.js, Rust, or Java.
Experience integrating security controls into cloud-native architectures such as Kubernetes, AWS/GCP/Azure, API gateways, or service meshes.

Technologies

Model Context Protocol (MCP); LLM tool-calling workflows
OpenAPI, TypeSpec, gRPC/Protobuf
Open Policy Agent (OPA), Rego, Cedar
OWASP Top 10, OWASP API Top 10, CWE/SANS 25, OWASP Top 10 for LLMs
OAuth 2.0, OIDC, SAML, mTLS, SPIFFE/SPIRE
RBAC, ABAC, ReBAC
Python, Go, TypeScript/Node.js, Rust, Java
Kubernetes, AWS, GCP, Azure, API gateways, service meshes
SAST, DAST, IAST, software composition analysis
Container image signing, SBOM tracking
OPA/Rego (also listed separately), Semgrep, CodeQL, CVE

Benefits

Medical, dental and vision insurance
401(k) plan with a Cisco matching contribution
Paid parental leave
Short and long-term disability coverage
Basic life insurance
Cisco restricted stock units that vest following continued employment with Cisco for defined periods
10 paid holidays per full calendar year
1 floating holiday for non-exempt employees
1 paid day off for employee’s birthday
Paid year-end holiday shutdown
4 paid days off for personal wellness determined by Cisco
Non-exempt employees: 16 days of paid vacation time per full calendar year, accrued at 4.92 hours per pay period for full-time employees
Exempt employees: flexible vacation time off program with no defined limit (subject to availability and some business limitations)
80 hours of sick time off provided on hire date and each January 1st thereafter, and up to 80 hours of unused sick time carried forward
Additional paid time away may be requested to deal with critical or emergency issues for family members
Optional 10 paid days per full calendar year to volunteer
For non-sales roles, employees may be eligible to earn annual bonuses subject to Cisco’s policies

Application window

The application window is expected to close on 10/30/2026.

Preferred qualifications

Experience with the security implications of the Model Context Protocol (MCP) or similar AI tool-invocation interfaces
Experience writing policy-as-code engines (Open Policy Agent, AWS Cedar, Oso/Polar) or custom linter/SAST rules (Semgrep, CodeQL)
Active involvement in application security research, CVE publications, open-source security tooling, or industry working groups (OWASP, CNCF Security, OASIS)
Relevant security certifications (for example, CISSP, CSSLP, CCSP, or AWS Certified Security)
Experience evaluating and securing LLM-powered applications, tool-use execution loops, and RAG architectures

View full job page →

17d ago

Penetration Tester

Packetlabs Miami, FL 🇺🇸 Remote

Miami, FL

17d ago

Full time Api Security Application Security Burp Suite

Apply Now

Job Description

Packetlabs is hiring a Penetration Tester for expert-level application security testing across multiple platforms.

Responsibilities

Conduct penetration testing across web applications, mobile applications, thick clients, and APIs.
Perform source code review and whitebox penetration testing to demonstrate real impact from application flaws.
Carry out reverse engineering of mobile and thick client applications.
When applicable, chain weaknesses to other environments, including cloud and on-prem AD infrastructure.
Run SAST and DAST on enterprise, SaaS, and custom in-house applications.
Use security scanners and apply validation/elimination techniques for false positives.
Develop detailed findings documentation, including remediation-focused reports for both technical and executive audiences.
Debrief testing results at both technical and executive levels.
Apply an OWASP-informed approach across Web, API, Mobile, and AI/LLM.

Requirements

Customer-first mentality.
Strong communication skills with clients, project managers, and teammates.
Ability to respond quickly and deliver work on time.
Take pride in the quality of delivered results.
Dig deeper into findings and continue testing until impact is proven.
Comfort working through challenges and obstacles, not avoiding them.
Experience adapting to a consulting-style environment with rapidly changing needs.
Ongoing learning mindset, with awareness of your own skillset and willingness to improve.
Self-motivated and dependable.
Humble team approach; egos are not a fit for Packetlabs.
Solid working knowledge of programming languages including: C, C#, Python, Objective-C, Java, JavaScript, SQL, and AngularJS.
Familiarity with web services and data formats including: XML, JSON, SOAP, REST, AJAX.
Understanding of AI/LLM weaknesses and flaws in applications.
Extensive experience using an attack proxy such as Burp Suite.
Professional qualifications (one or more): OSCP, OSWE, BSCP.
OSCP or Burp is mandatory for this organization.
Must be located in Florida.
Minimum experience: 3 years.
Education: graduate of a post-secondary college or university degree program.

Technologies

C, C#, Python, Objective-C, Java, JavaScript, SQL, AngularJS
XML, JSON, SOAP, REST, AJAX
Burp Suite, SAST, DAST
OSCP, OSWE, BSCP
OWASP

Benefits

Competitive compensation and growth opportunity
Paid education and professional development reimbursement for certifications and technical growth
Flexible work environment
Paid volunteer day each year
Paid Birthday day off
Paid U.S. public holidays
Fully remote within Texas or Florida

Additional Notes (At-Will Employment)

This position is at-will. This job posting does not constitute an employment contract or guarantee of continued employment.

View full job page →

18d ago

Senior Penetration Tester (Mobile, API, Cloud)

U.S. Bank National Association Irving, TX

Irving, TX

18d ago

$120k - $141k/yr Full time Senior Api Security Application Security

Apply Now

Job Description

U.S. Bank National Association is looking for a Senior Penetration Tester to drive advanced offensive security assessments across mobile, API, web, and cloud environments. This onsite role in Irving, TX focuses on uncovering security weaknesses, validating real-world business impact through controlled exploitation, and partnering with engineering teams to strengthen the enterprise security posture.

What you’ll do

Lead penetration testing engagements spanning mobile applications, APIs, web applications, cloud platforms, and supporting infrastructure.
Conduct manual security testing and controlled exploitation to identify vulnerabilities, validate risk, and demonstrate business impact.
Evaluate application security against frameworks including OWASP Top 10, OWASP API Security Top 10, OWASP MASVS, and MASTG.
Assess security controls within AWS, Azure, containerized environments, and Kubernetes platforms.
Perform threat modeling and risk assessments to prioritize testing activities and remediation focus.
Produce detailed security reporting with vulnerability analysis, risk ratings, attack paths, and remediation recommendations.
Build and improve security testing tools, scripts, and automation to increase operational effectiveness and assessment coverage.
Mentor junior testers, support knowledge-sharing, and collaborate with stakeholders to improve enterprise security practices.

What you bring

Bachelor’s degree in Engineering or Science, or equivalent work experience.
Eight or more years of experience in information security.
Two or more years of experience in IT infrastructure management, application architecture, risk management, data architecture, middleware technology, and IT operations and project management.
8+ years of information security experience with proven offensive security and penetration testing expertise.
5+ years of hands-on mobile application security testing for Android and iOS platforms.
Strong knowledge of OWASP Top 10, API Security Top 10, SANS Top 25, OWASP MASVS, and MASTG.
Advanced experience with manual penetration testing, exploit chaining, business logic testing, and access control assessments.
Expert proficiency with Burp Suite Pro, Postman, Insomnia, Nmap, Metasploit, Kali Linux, and related security testing tools.
Experience assessing security within AWS, Azure, Kubernetes, containerized environments, and cloud-native security platforms.
Strong scripting and automation skills using Python, PowerShell, Bash, Ruby, or Go.
Deep understanding of HTTP/S, REST APIs, OAuth, SAML, JWT, TCP/IP, DNS, firewalls, and IDS/IPS, plus application architecture.
Knowledge of AI and machine learning security risks, including prompt injection, insecure model access, API abuse, and data leakage concerns.
Familiarity with security and compliance frameworks including PCI-DSS, HIPAA, NIST 800-53, ISO 27001, FedRAMP, and other security compliance frameworks.
Excellent communication skills to present findings to technical teams, business stakeholders, and executive leadership.

Tools and technologies you’ll work with

OWASP Top 10, OWASP API Security Top 10, OWASP MASVS, MASTG
AWS, Azure, Kubernetes, containerized environments
Burp Suite Pro, Postman, Insomnia, Nmap, Metasploit, Kali Linux
Python, PowerShell, Bash, Ruby, Go
HTTP/S, REST APIs, OAuth, SAML, JWT, TCP/IP, DNS, firewalls, IDS/IPS
PCI-DSS, HIPAA, NIST 800-53, ISO 27001, FedRAMP, SANS Top 25
AI and machine learning security

Compensation and location

Location: Irving, TX (onsite)
Salary: USD 119,765 to 140,900 per year
Onsite expectation: Working from a U.S. Bank location three (3) or more days per week is required.

Benefits

Healthcare (medical, dental, vision)
Basic term and optional term life insurance
Short-term and long-term disability
Pregnancy disability and parental leave
401(k) and employer-funded retirement plan
Paid vacation (from two to five weeks depending on salary grade and tenure)
Up to 11 paid holiday opportunities
Adoption assistance
Sick and Safe Leave accruals of one hour for every 30 worked, up to 80 hours per calendar year unless otherwise provided by law