[Remote] API Security Engineer

Note: The job is a remote job and is open to candidates in USA. Moderna is a leading mRNA technology company focused on transforming medicine. They are seeking a Cybersecurity Engineer to enhance their API security capabilities, collaborating with various teams to address security risks and improve API management.

Responsibilities

• Help design, implement, and mature Moderna’s API security capabilities across enterprise applications, shared services, integrations, and AI-related platforms
• Support the evaluation, deployment, and operationalization of API security technologies used for API discovery, posture assessment, traffic monitoring, anomaly detection, and policy enforcement
• Partner with application, platform, and engineering teams to identify insecure API designs, weak authentication or authorization patterns, excessive data exposure, and other common API security risks
• Perform API-focused threat modeling and security assessments for modern services, microservices, integrations, and AI-enabled workflows
• Define and promote secure API engineering practices, including strong authentication, authorization, rate limiting, schema validation, secrets handling, and secure service-to-service communication
• Help shape security approaches for non-human and agentic identity models, including how services, automation, and software agents authenticate to APIs, obtain scoped access, and interact with sensitive systems safely
• Analyze API telemetry and findings to identify abuse paths, misconfigurations, shadow APIs, and control gaps, then work with stakeholders to drive remediation
• Collaborate with broader security teams to connect API security findings with cloud, application, identity, and detection engineering workflows
• Provide practical engineering guidance that helps teams improve API security while preparing for new trust and identity challenges introduced by automation and AI-enabled systems

Skills

• 5+ years of experience in cybersecurity, application security, platform security, or a related engineering discipline, with meaningful hands-on experience in API security
• Strong understanding of API security risks and controls, including authentication, authorization, token handling, rate limiting, data exposure, input validation, and service-to-service trust models
• Experience assessing or securing REST, GraphQL, or other modern API patterns in cloud-native or distributed application environments
• Experience working with engineering and platform teams to improve API design, security posture, and operational controls
• Familiarity with API gateways, service meshes, reverse proxies, or related control points used to secure and observe API traffic
• Ability to perform threat modeling and technical risk assessments for APIs, integrations, backend services, and machine-to-machine interaction patterns
• Strong analytical and troubleshooting skills, with the ability to turn technical findings into pragmatic remediation guidance
• Strong written and verbal communication skills, with the ability to work across technical and non-technical stakeholder groups
• Working knowledge of identity and access concepts relevant to non-human identities, workload identities, and emerging agentic access patterns is strongly preferred
• Working knowledge of cloud and application security fundamentals, including identity, secrets management, logging, and common security design patterns
• Familiarity with AI-enabled architectures or gateway patterns is a plus, particularly where APIs are used to broker access to models, tools, or sensitive data flows

Benefits

• Competitive healthcare, plus voluntary benefit programs to support your unique needs
• A holistic approach to well-being, with access to fitness, mindfulness, and mental health support
• Family planning benefits, including fertility, adoption, and surrogacy support
• Generous paid time off, including vacation, volunteer days, sabbatical, global recharge days, and a discretionary year-end shutdown
• Savings and investments to help you plan for the future
• Location-specific perks and extras

Company Overview