API Security Engineer

Location: 4910 Tiedeman Road, Brooklyn Ohio

API Security Engineer Role Overview

We are seeking an experienced API & Application Security Engineer with expertise in API security, Web Application Firewall (WAF/WAAP), application security, API gateway integrations, security architecture, and threat modeling. This role is responsible for designing, deploying, integrating, administering, and optimizing enterprise API and application security controls across cloud, on-premises, containerized, and hybrid environments. The engineer will partner directly with application development, security architecture, DevOps/SRE, cloud, network, SOC, middleware, and platform engineering teams to identify security risks, implement protections, investigate threats, automate security processes, and drive remediation.

Key Responsibilities

API Security

Deploy, configure, administer, and optimize enterprise API security platforms and controls. Perform continuous API discovery, inventory, classification, and security posture management. Identify shadow, rogue, zombie, deprecated, and undocumented APIs. Analyze API traffic, endpoints, parameters, authentication mechanisms, sensitive-data flows, and behavioral patterns. Identify vulnerabilities including BOLA/IDOR, broken authentication and authorization, injection, SSRF, excessive data exposure, security misconfigurations, and business-logic abuse. Assess APIs against the OWASP API Security Top 10 and organizational security standards. Investigate API security alerts and coordinate remediation with engineering and application teams. Integrate API security findings with SIEM, SOAR, vulnerability management, incident response, and ticketing workflows.

eBPF Agent / Sensor Deployment

Design, deploy, configure, and maintain eBPF-based API security agents and sensors across Linux, containerized, Kubernetes, and cloud environments. Deploy traffic-collection components to provide visibility into API communications and application behavior. Validate operating-system, kernel, container runtime, Kubernetes, networking, and infrastructure prerequisites for eBPF deployments. Troubleshoot agent installation, connectivity, permissions, kernel compatibility, traffic visibility, telemetry collection, and performance issues. Validate that deployed sensors provide appropriate API visibility while minimizing application and infrastructure impact. Develop standards and automation for repeatable, enterprise-scale agent deployments. Support agent upgrades, configuration changes, health monitoring, troubleshooting, and lifecycle management. Apply least-privilege and secure deployment practices to agent permissions and runtime configurations.

API Gateway & middleware Integrations

Integrate API security platforms with enterprise API gateways, middleware platforms, reverse proxies, ingress controllers, and traffic-management technologies. Work with API proxies, products, policies, routing configurations, authentication mechanisms, and traffic-management controls. Configure and validate API traffic visibility between gateways and API security platforms. Review gateway policies for authentication, authorization, rate limiting, TLS/mTLS, data exposure, routing, and security-control weaknesses. Support integrations with both cloud-native API management platforms and enterprise on-premises gateway appliances. Configure and validate traffic forwarding, mirroring, logging, telemetry, or other supported collection mechanisms. Troubleshoot connectivity, certificate, traffic collection, API discovery, and integration issues. Partner with gateway administrators, middleware engineers, application teams, and platform owners to remediate identified security weaknesses.

Web Application Firewall / WAAP

Deploy, configure, administer, and optimize enterprise WAF/WAAP security controls. Configure and tune WAF policies, custom rules, rate controls, network/IP controls, and application protections. Analyze traffic and security events to identify attacks, anomalous activity, and false positives. Investigate SQL injection, XSS, command injection, path traversal, file inclusion, malicious automation, and other application-layer attacks. Onboard applications and APIs to enterprise web and API protection services. Tune security policies to maintain effective protection while minimizing impact to legitimate application traffic. Support security incident investigations using WAF, API, application, and network telemetry.

Security Architecture & Threat Modeling

Perform security architecture reviews for APIs, web applications, microservices, API gateways, middleware platforms, Kubernetes, containers, and cloud environments. Conduct threat modeling to identify attack surfaces, trust boundaries, abuse cases, authorization risks, sensitive-data exposure, and potential control gaps. Review authentication and authorization architectures involving OAuth 2.0, OIDC, JWT, API keys, mTLS, IAM, RBAC, and other access-control mechanisms. Evaluate end-to-end API traffic flows from clients through edge-security controls, gateways, middleware, microservices, and backend applications. Recommend preventive, detective, and compensating security controls based on identified risks. Participate in application and infrastructure design reviews and promote secure-by-design engineering practices.

Application Security & Automation

Perform application and API security assessments using manual and automated testing techniques. Apply the OWASP Top 10 and OWASP API Security Top 10 to application and API assessments. Perform request and response analysis, vulnerability validation, and remediation verification. Work with intercepting proxies, API clients, command-line testing tools, SAST, DAST, SCA, and API security testing technologies. Integrate application and API security testing into CI/CD and DevSecOps pipelines. Develop automation using Python, Bash, PowerShell, Go, JavaScript, APIs, or similar technologies. Automate agent deployment, configuration validation, API onboarding, security testing, reporting, alert enrichment, and vulnerability-management workflows. Work directly with developers to explain vulnerabilities, recommend practical remediation, and validate fixes.

Education & Experience

Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, Information Systems, Computer Engineering, Software Engineering, or a related technical discipline and relevant professional experience; or An equivalent combination of college education, technical training, industry certifications, and hands‑on cybersecurity experience. Candidates with an Associate degree, relevant college coursework, technical certifications, or substantial professional experience in lieu of a four-year degree may be considered. Demonstrated professional experience in API security, application security, WAF/WAAP engineering, security architecture, DevSecOps, cloud security, vulnerability management, or security engineering. Hands‑on experience deploying and supporting enterprise API security, application security, API gateway, and traffic‑monitoring technologies is strongly preferred.

Required Technical Qualifications

Hands‑on experience with enterprise API security technologies. Experience deploying, configuring, and tuning WAF/WAAP security controls. Understanding of eBPF‑based agent/sensor deployment and troubleshooting in Linux, Kubernetes, containerized, and cloud environments. Experience integrating API security platforms with enterprise API gateways and API management technologies. Strong knowledge of DNS, TLS/mTLS, REST, GraphQL, JSON, OpenAPI/Swagger, web services, and API gateway architectures. Strong understanding of the OWASP API Security Top 10 and OWASP Top 10. Knowledge of OAuth 2.0, OIDC, JWT, API keys, IAM, RBAC, and modern API authorization models. Experience performing security architecture reviews and threat modeling. Working knowledge of public cloud platforms, Kubernetes, containers, Linux, and microservices. Experience with secure SDLC, DevSecOps, CI/CD, vulnerability management, and incident‑response processes. Ability to troubleshoot complex integrations across applications, gateways, middleware, networks, security controls, and cloud infrastructure. Ability to work directly with developers, architects, API gateway teams, middleware engineers, DevOps/SRE, cloud, network, SOC, and infrastructure teams.

Preferred Qualifications

Experience operating enterprise‑scale API security and application security environments. Experience with eBPF‑based API traffic collection and Kubernetes/Linux sensor deployments. Advanced experience integrating security platforms with cloud‑based API management solutions and enterprise gateway appliances. Experience with API gateways, reverse proxies, service meshes, ingress controllers, and load‑balancing technologies. Experience integrating security telemetry with SIEM/SOAR platforms. Experience with penetration testing and adversarial API/application security assessments. Familiarity with STRIDE, attack trees, or comparable threat‑modeling methodologies. Experience developing security tooling and automation at enterprise scale. Relevant industry certifications in information security, application security, penetration testing, cloud security, or DevSecOps are preferred but not required.

Key Technical Skills

• API Security
• Application Security
• WAF/WAAP
• eBPF
• Linux
• Kubernetes
• API Gateway Security
• API Management
• API Discovery
• API Posture Management
• REST
• GraphQL
• OWASP API Top 10
• OWASP Top 10
• OAuth 2.0
• OIDC
• JWT
• TLS/mTLS
• OpenAPI/Swagger
• DevSecOps
• CI/CD
• Python
• Security Automation
• Threat Modeling
• Security Architecture
• Cloud Security
• SIEM/SOAR
• Vulnerability Management

What Success Looks Like

The successful candidate will serve as a technical subject‑matter expert for enterprise API and application security, with the ability to deploy and troubleshoot eBPF‑based security agents, integrate security capabilities with cloud and on‑premises API gateway technologies, and secure complex enterprise API architectures. The engineer will combine hands‑on security engineering with API security, WAF/WAAP, application security, security architecture, threat modeling, cloud security, DevSecOps, and automation expertise while working directly with engineering teams to implement scalable secure‑by‑design solutions.

COMPENSATION AND BENEFITS

This position is eligible to earn a base salary in the range of $116,000.00 - $216,000.00 annually. Placement within the pay range may differ based upon various factors, including but not limited to skills, experience and geographic location. Compensation for this role also includes eligibility for incentive compensation which may include production, commission, and/or discretionary incentives.

Key has implemented an approach to employee workspaces which prioritizes in‑office presence, while providing flexible options in circumstances where roles can be performed effectively in a mobile environment.

Job Posting Expiration Date: 10/26/2026

KeyCorp is an Equal Opportunity Employer committed to sustaining an inclusive culture. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, genetic information, pregnancy, disability, veteran status or any other characteristic protected by law. Qualified individuals with disabilities or disabled veterans who are unable or limited in their ability to apply on this site may request reasonable accommodations by emailing View email address on click.appcast.io.

#LI-Remote KeyBank is an organization collectively committed to helping you unlock your potential and discover what truly drives you.

Working here means sharing our purpose to help our clients, colleagues, and communities thrive.

For 200 years, Key has opened doors in our communities. Let us open one for you.