Security Engineer, WAF & API Security

You are a software engineer who specializes in security. This role owns Layer 7 defense for a cloud-native fintech environment: WAF, API security, and bot protection for customer-facing applications running across AWS and GCP. You will design and tune the controls, write the automation behind them, and partner closely with the platform and product teams who ship the apps you protect. You will also help secure the cloud network fabric that carries the traffic and contribute to a growing zero trust program, but the core of the job is application and edge security, built and operated by someone who codes.

• Computer science background or equivalent software engineering foundation; you build and automate, you don’t just configure \n

• 7+ years in application, cloud, or product security, with strong hands-on Layer 7 experience \n

• Deep WAF experience at scale (AWS WAF, Cloudflare, Akamai, Imperva, or comparable) plus API security \n

• Bot mitigation and protection against OWASP Top 10, DDoS, credential stuffing, and API abuse \n

• Hands-on AWS depth, working knowledge of GCP, and comfort with CloudFront, ALB, API Gateway, and Web ACLs \n

• Strong scripting and automation in Python \n

• Cloud network fundamentals: VPC design, segmentation, route tables, and security groups \n

• Terraform and a policy-as-code approach \n

• Fintech, SaaS, or cloud-native background preferred \n

• Exposure to ZTNA or Zscaler and modern segmentation is a plus \n

• Familiarity with Kubernetes networking and service mesh is a plus

Compensation: $190,000 to $210,000 base plus a 20% annual cash bonus.

\n

Logistics: 100% remote within the US. Full time.

\n

Here’s what you’ll be doing:

\n \n

• Own Layer 7 defense across the application edge: WAF, API security, bot management, and rate limiting against OWASP Top 10 and API abuse \n

• Design and tune WAF rule sets and Web ACLs, including managed and rate-based rules, across CloudFront, ALB, and API Gateway \n

• Build API security controls at the gateway: schema validation, authentication, throttling, and abuse detection \n

• Run bot mitigation and defend against DDoS, credential stuffing, and aggregator abuse for customer-facing apps \n

• Correlate WAF, bot, and load balancer telemetry for detection, and write the automation and tooling behind response in Python \n

• Secure the cloud network fabric that carries application traffic: VPC design, segmentation, route tables, and security groups across AWS and GCP \n

• Codify controls as policy-as-code in Terraform \n

• Contribute to the zero trust and ZTNA rollout and to securing Kubernetes networking as the environment scales \n

• Own initiatives from design through delivery and partner closely with platform and product teams \n

\n