Senior Application and Cloud Security Engineer

This role focuses on securing Apigee APIs, Google Cloud Platform (GCP), and Google Kubernetes Engine (GKE) environments while reviewing the security of AI and Mendix applications. The position also involves coordinating C4-related tasks to ensure robust security measures across various platforms and applications.

Key Responsibilities
- Develop and implement shared authentication and authorization flows within Apigee, incorporating OAuth 2.0, OpenID Connect, JWT, mutual TLS, quotas, threat protection, and externalizing secrets.
- Manage Google Cloud IAM privileges by reducing excessive permissions, governing service accounts and keys, enforcing organization policies, and applying VPC Service Controls to secure GCP resources and GKE clusters.
- Safeguard AI assistant components, including prompts, grounding content, tools, and configurations. Address and remediate approved prompt injection vulnerabilities and data access issues.
- Collaborate with customer Mendix developers to review entity access and XPath constraints, ensuring secure application design while allowing developers to implement necessary code changes.
- Coordinate C4 activities alongside database engineers and customer development teams, conducting functional and authorization regression testing to validate security controls.

Required Qualifications
- 3 to 5 years of experience or more in securing APIs using Apigee, with strong expertise in OAuth 2.0, OpenID Connect, JWT, and mutual TLS protocols.
- Practical, hands-on experience with Google Cloud security best practices and securing GKE environments.
- Solid background in application security, including familiarity with risks related to AI or large language model (LLM) applications.

Preferred Qualifications
- Exposure to Mendix platform security is advantageous, enhancing the ability to collaborate effectively with Mendix developers and understand platform-specific constraints.

This position offers the opportunity to work at the intersection of cloud security, API management, and emerging AI application risks, contributing to the protection of critical infrastructure and innovative technologies.