API Security Engineer

API Security Engineer

About Cequence Security

Cequence Security helps organizations discover, protect, and manage APIs and web applications. We’re looking for an engineer to strengthen API security through practical testing, threat analysis, and collaboration with development and security teams.

Responsibilities

• Assess APIs for vulnerabilities, misconfigurations, and business logic flaws.
• Perform API penetration testing and security reviews across REST, GraphQL, and other API architectures.
• Analyze API traffic and investigate abuse, bot activity, and emerging attack patterns.
• Recommend security controls, including authentication, authorization, rate limiting, and input validation.
• Work with engineering and product teams to remediate findings and improve secure development practices.
• Create clear security reports, documentation, and guidance for customers and internal teams.
• Keep current with API security standards, attack techniques, and relevant tools.

Qualifications

• Experience in application security, API security, penetration testing, or a related field.
• Familiarity with HTTP, REST APIs, JSON, OAuth 2.0, OpenID Connect, and JWT.
• Understanding of common API risks, such as broken access control, injection, data exposure, and abuse.
• Experience with tools such as Burp Suite, Postman, OWASP ZAP, or similar.
• Ability to script in Python, JavaScript, or another language.
• Strong communication skills and the ability to explain technical findings clearly.

Preferred qualifications

• Familiarity with the OWASP API Security Top 10.
• Experience with cloud platforms, containers, and API gateways.
• Relevant certifications such as OSCP, GWAPT, or a cloud security certification.