AVP- API Security

Job Title: AVP- API Security

Work Type: Permanent

Location: Embassy Park - Bengaluru

Role Overview

We build the API Security platform that thousands of engineers across NAB use to keep their APIs safe. We build platforms, not features - you will not run clusters or own enterprise security policy; you will build the platform other teams use to enforce it. We are moving security from reactive to predictive: every code change evaluated for risk before it lands, findings arriving as automated pull requests with confidence-scored fixes, and executive risk reported as cost - not compliance jargon.

Key Responsibilities

• Design, build, and operate the API Security platform - control catalogue, policy engine (detect and enforce), portfolio scoreboard, and assisted remediator.
• Ship secure-by-default abstractions and paved-road patterns that make the secure path the easiest path.
• Automate the platforms operational lifecycle - CI/CD, credential and certificate rotation, health monitoring, and policy testing.
• Build the vulnerability remediation platform - findings auto-generated PRs with rule-based fix templates.
• Write and manage runtime security policy as code (service mesh, gateway, detection rules).
• Instrument observability and alerting for engineering, security, and executive stakeholders.
• Own what you release - investigate detections after they ship, resolve false positives and policy defects, and drive production fixes.
• Collaborate with global engineering teams, platform teams, and security vendors.

Required Skills

• 6-12 years in API development, platform engineering, or backend engineering (Python, Go, or Java).
• Strong grounding in API security - OWASP API Top 10, OAuth 2.0 / OIDC / JWT, mTLS, BOLA, IDOR, injection.
• Kubernetes, containers, modern CI/CD, and Infrastructure as Code (Terraform, Ansible, or equivalent).
• Policy as code - declarative, version-controlled runtime security policy.
• Cloud (AWS preferred) and observability platforms (logs, metrics, traces, alerting).
• Strong learning mindset and a product mindset toward internal users - clean APIs, honest errors, real documentation.

Qualifications

• Degree in CS / SE / IS or equivalent experience. Certifications such as AWS Solutions Architect, CKA, OSCP, or CISSP are advantageous.