> Markdown version of [/jobs/ext/4584114-staff-software-engineer](https://www.wearedevelopers.com/jobs/ext/4584114-staff-software-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Staff Software Engineer - **Company:** Realty Professionals, LLC - **Location:** Austin, TX, United States - **Experience:** Expert - **Contract:** Permanent contract - **Skills:** Application Programming Interfaces (APIs), Computer Programming, Continuous Integration, Identity and Access Management, Mobile Application Software, Python (Programming Language), Key Management, OAuth, OpenID, Open Web Application Security, JSON Web Token, SQL Databases, TypeScript, Policy as Code, Software Security, Rate Limiting, Kubernetes, Graphql, Api Gateway - **Published:** November 5, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=327d8ad927b56590 ## About the Role * 8+ years in security, platform or backend engineering, with 5+ years focused on API or application security at large scale. Bachelor's degree or equivalent experience. * Deep knowledge of API security: OAuth 2.0/OIDC, JWT, API keys and client identity, mTLS, and the OWASP API Security Top 10. * Hands-on GraphQL security experience: federation, persisted queries and safelists, query cost analysis, introspection controls, and authorization patterns. * Experience operating an API gateway (such as Tyk, Kong or AWS API Gateway), including policy design, rate limiting and key management. * Kubernetes and policy-as-code experience (ValidatingAdmissionPolicy, OPA or Kyverno), plus infrastructure as code and CI/CD. * Strong programming skills in at least one language such as Go, TypeScript or Python, and comfort reading and changing service code. * Experience with abuse and fraud patterns: credential stuffing, account takeover, scraping and bot-driven form abuse, and how to detect them with logs and SQL. * A record of leading multi-team technical initiatives, and of explaining risk to executives in business terms., * Experience with Apollo GraphQL Federation and its router, or with Auth0 or similar identity platforms. * Experience with mobile app attestation (App Attest, Play Integrity) or API bot protection. * Experience building a security function or team from scratch. ## Description Our apps and websites run on APIs. A public API gateway and a federated GraphQL platform carry billions of requests a month, covering listings, search, sign-in, saved homes, and the leads we send to agents. As the founding Staff engineer for API security on our new Edge and API Security team, you'll set the technical direction for how we protect them. You'll decide how every API is authenticated, which operations are allowed, how abuse is detected and stopped, and how new APIs ship secure by default. You'll work hands-on and lead through influence across platform, product, identity and security teams, with leadership backing and a clear mandate., * A Key technical role on a high impact team. You'll shape its architecture, standards and hiring from day one. * Real scale: billions of API and GraphQL requests a month, and abuse that ranges from scraping to account takeover. * Direct business impact: your work protects consumer accounts, the quality of leads sent to agents, and the data that powers our business. * A modern stack, all managed as code: an API gateway, Apollo GraphQL Federation, Kubernetes and policy-as-code. * Room to apply automation and AI to detection and response. * Leadership that wants guardrails built into the platform, not more tickets. What You'll Do: * Own the API security architecture across the API gateway and the GraphQL platform, and set the multi-quarter roadmap. * Define and enforce an authentication standard for every public API, and lead the migration of existing unauthenticated APIs to it, working with the owning teams. * Secure GraphQL end to end: approved-operation lists and persisted queries, depth and cost limits, field-level authorization, and safe schema change. * Protect high-value flows such as sign-in, registration, account and lead submission against credential stuffing, account takeover, scraping and fake submissions. * Make "secure by default" real, using admission policies, CI checks and gateway policies that stop an unprotected API from reaching production. * Build detection and alerting on API abuse, so attacks surface in minutes, not in downstream business reports. * Lead response to API attacks and abuse, and turn every incident into a lasting fix. * Mentor engineers, set API security review standards, and help hire the rest of the team.