Security Engineer, WAF & API Security

Security Engineer, WAF & API SecurityYou are a software engineer who specializes in security. This role owns Layer 7 defense for a cloud-native fintech environment: WAF, API security, and bot protection for customer-facing applications running across AWS and GCP. You will design and tune the controls, write the automation behind them, and partner closely with the platform and product teams who ship the apps you protect. You will also help secure the cloud network fabric that carries the traffic and contribute to a growing zero trust program, but the core of the job is application and edge security, built and operated by someone who codes.Compensation: $190,000 to $210,000 base plus a 20% annual cash bonus.Logistics: 100% remote within the US. Full time.Here's what you'll be doing:Own Layer 7 defense across the application edge: WAF, API security, bot management, and rate limiting against OWASP Top 10 and API abuseDesign and tune WAF rule sets and Web ACLs, including managed and rate-based rules, across CloudFront, ALB, and API GatewayBuild API security controls at the gateway: schema validation, authentication, throttling, and abuse detectionRun bot mitigation and defend against DDoS, credential stuffing, and aggregator abuse for customer-facing appsCorrelate WAF, bot, and load balancer telemetry for detection, and write the automation and tooling behind response in PythonSecure the cloud network fabric that carries application traffic: VPC design, segmentation, route tables, and security groups across AWS and GCPCodify controls as policy-as-code in TerraformContribute to the zero trust and ZTNA rollout and to securing Kubernetes networking as the environment scalesOwn initiatives from design through delivery and partner closely with platform and product teamsAnd what you need to have:Computer science background or equivalent software engineering foundation; you build and automate, you don't just configure7+ years in application, cloud, or product security, with strong hands-on Layer 7 experienceDeep WAF experience at scale (AWS WAF, Cloudflare, Akamai, Imperva, or comparable) plus API securityBot mitigation and protection against OWASP Top 10, DDoS, credential stuffing, and API abuseHands-on AWS depth, working knowledge of GCP, and comfort with CloudFront, ALB, API Gateway, and Web ACLsStrong scripting and automation in PythonCloud network fundamentals: VPC design, segmentation, route tables, and security groupsTerraform and a policy-as-code approachFintech, SaaS, or cloud-native background preferredExposure to ZTNA or Zscaler and modern segmentation is a plusFamiliarity with Kubernetes networking and service mesh is a plusNo CTC or sponsorship at this time.