Staff Security Engineer, API Security
PayPal Holdings, Inc. (company site, opens in a new tab)5+ yrsBengaluruOn-siteDirect career pageEst. 35–60 LPA
Posted on 10 Sept
Reach people at PayPal Holdings, Inc.
People at this company you can reach
Log in to see who works here
Create a free account or log in to see the people at PayPal Holdings, Inc. you could write to:
- Recruiters & HR
- People in this function
- Work addresses
Your match
Against your primary resume
Log in to see your match score
Create a free account or log in to unlock your CV match score across:
- Role fit
- Experience
- Industry relevance
Protocol Intelligence
How competitive this role is
Competition
Background fit
Strictness
Log in to see why each signal reads the way it does.
Job description
Structured overview of role & requirements
About This Role
- Own the design and delivery of an advanced API security capability platform consolidating multiple tools into a unified policy-as-code enforcement architecture.
- Lead complex API security projects including pre-release gateway enforcement controls and the end-to-end DAST tooling strategy execution.
- Extend API security into supply-chain related areas like pipeline access and artifact verification and provide technical leadership across the security and engineering teams.
Minimum Requirements
- Bachelor’s degree with 5+ years relevant experience or equivalent combination of education and experience.
- 5+ years hands-on software engineering experience with staff-level ownership, proficient in Python or Go.
- Deep expertise in API security architectures including REST, GraphQL, AsyncAPI, OAuth2, and API gateways/service meshes (Envoy or equivalent).
- Working knowledge of policy-as-code enforcement, DAST/SAST tooling, and security fundamentals across product and cloud environments.
Ideal Candidate Profile
- Experienced staff-level engineer with end-to-end platform ownership and strong technical leadership skills in API security domain.
- Strategic thinker capable of shaping security roadmaps to anticipate emerging business and security challenges, not just executing pre-defined tasks.
- Practitioner with practical knowledge of API threat models including AI-driven risks, supply-chain security integration, and API abuse mitigation controls.