Senior API Security Engineer
Encora, Kuala Lumpur
- Pay
- Not listed by the employer
- Work type
- Not stated
- Level
- Senior
- Area
- Security engineering
- Posted
- Jun 22, 2026
About the role
Key Responsibilities: ● API Logic Security: Hunt for Business Logic vulnerabilities (BOLA/IDOR, Mass Assignment) that traditional firewalls miss. ● Authentication & Authorization: Design and validate OAuth2, OIDC, and JWT implementations to ensure users can only access their own data. ● Attack Simulation: Script automated attacks against the API Gateway to test rate limiting and fraud detection rules. ● Gateway Hardening: Work with the Platform team to configure the API Gateway (Kong, or Azure API Gateway) for maximum security. ● Auth & Partner Integration: Deliver new security design patterns and components for authentication, authorization, SSO, MFA, and Partner security. Standardize how we consume external APIs (Open Banking) and how we secure our own exposed endpoints.
Technical Requirements: ● Strong scripting skills (Python) to automate API attacks. ● Expertise in REST and GraphQL security. ● Deep knowledge of OAuth 2.0 and OpenID Connect (OIDC) flows. ● Experience with API Security tools (Postman, Burp Suite, 42Crunch).
Similar roles at other companies
Software Engineer, Security
CohereToronto +5
$180K–$325K / yr
Posted Sep 17, 2026
Pay not posted
Posted Oct 2, 2026
Pay not posted
Posted Jun 9, 2026
Pay not posted
Posted Jun 9, 2026
Senior Information Security Engineer
Optiver Sydney, Australia +1
Listed on Encora's Greenhouse job board; checked 29 h ago. First seen by us 29 h ago. Being listed doesn't mean the team is actively interviewing. We found this board in a public directory and haven't yet confirmed it against the company's own careers page.