Senior Security Engineer

Senior Security Engineer

An opportunity for a Senior Security Engineer to join a central security platform team within a leading financial institution. The team is building and expanding a new API security platform that will play an important role in protecting the organisation’s customer, partner and internal API landscape.

This role is broader than a traditional API Security Engineer position. The team is looking for someone with a strong engineering background combined with hands-on application or web application security experience. You do not need to have worked with every API security tool already; the focus is on having the right security foundation, technical mindset and ability to develop further into API security.

What you will do

• Help secure APIs and applications by identifying vulnerabilities and assessing their severity and impact.
• Translate security standards, controls and findings into practical technical improvements.
• Contribute to security policies, platform rules and automated guardrails.
• Work with engineers, architects and security specialists to ensure applications and APIs are secure by design.
• Support the development and extension of the central API security platform.
• Analyse application and API security risks and help teams understand how these should be mitigated.
• Work with authentication and authorization mechanisms such as OAuth, JWT, mTLS and session management.
• Contribute to the continuous improvement of security controls, standards and engineering practices.
• Build knowledge of the API security tooling used within the team and grow further into the specialist domain.

The profile we are looking for

You are a senior engineer with a strong technical background and clear hands-on security experience. Your background could be in application security, product security, DevSecOps, security engineering, secure software development, API integration security or a similar area.

The most important requirement is proven experience with application security or web application security.

You bring:

• Strong hands-on experience with application security and/or web application security.
• A solid engineering background, for example as a Security Engineer, AppSec Engineer, Product Security Engineer, DevSecOps Engineer, Security Consultant or security-focused developer.
• Strong knowledge of OWASP Top 10 and common application vulnerabilities.
• Experience identifying, analysing and prioritising security findings.
• Good understanding of secure application architecture and cybersecurity principles.
• Knowledge of authentication and authorization mechanisms such as:
• OAuth
• JWT
• mTLS
• Session management
• Object-level authorization
• Attribute-level authorization
• Ability to translate security requirements into practical controls, policies and remediation actions.
• Strong communication skills and the ability to work effectively with engineering, architecture and security teams.
• A proactive mindset and willingness to take ownership.

Nice to have

• Experience with API security or securing REST APIs.
• Experience within a CISO or central security engineering environment.
• Knowledge of MITRE and CVE.
• Experience with API security platforms such as Akamai Noname, Salt Security or Cequence.
• Experience translating security findings into automated platform controls or guardrails.

Direct experience with these specific API security tools is not required. The right senior engineer can learn the tooling after joining.

This is a strong opportunity for someone with a solid application security and engineering foundation who wants to deepen their specialization in API security while helping build and mature a strategic security platform.