Senior Application and Cloud Security Engineer

This role focuses on securing Apigee APIs, Google Cloud Platform (GCP), and Google Kubernetes Engine (GKE), while also reviewing the security of AI and Mendix applications. The position involves coordinating C4-related tasks to ensure comprehensive security coverage across multiple platforms and technologies.

Key Responsibilities
- Develop and implement shared authentication and authorization flows within Apigee, incorporating OAuth 2.0, OpenID Connect, JWT, and mutual TLS. Manage quotas, threat protection, TLS/mTLS configurations, and externalize secrets to enhance API security.
- Minimize Google Cloud IAM privileges by governing service accounts and keys, enforcing organization policies, and applying VPC Service Controls to secure cloud resources. Ensure GKE clusters are properly secured following best practices.
- Safeguard AI assistant components, including prompts, grounding content, tools, and configuration settings. Address and remediate approved prompt injection vulnerabilities and data access issues related to AI applications.
- Collaborate closely with customer Mendix developers to review entity access and XPath constraints, providing security guidance while developers implement necessary code changes.
- Coordinate C4 security efforts alongside database engineers and customer developers. Conduct functional and authorization regression testing to validate security controls and workflows.

Required Qualifications
- 3 to 5 years of hands-on experience securing APIs on Apigee, with strong expertise in OAuth 2.0, OpenID Connect, JWT, and mutual TLS.
- Practical experience with Google Cloud security, including IAM privilege management, service account governance, organization policies, VPC Service Controls, and securing GKE environments.
- Solid application security background, particularly with AI or large language model (LLM) application risks.
- Familiarity with Mendix platform security is advantageous but not mandatory.

This position offers the opportunity to work at the intersection of cloud security, API management, and emerging AI application risks, making it ideal for professionals looking to deepen their expertise in securing modern, cloud-native environments.