Sr External Web Application & API Security Engineer
McDonald's26 days ago
Base Salary
$138k - $173k/yr
Responsibilities
- Lead API discovery, inventory, classification, ownership mapping, posture management, runtime detection, attacker-behavior analysis, and risk prioritization.
- Assess APIs for authentication, authorization, data exposure, schema, input-validation, rate-control, and other OWASP API Security Top 10 risks, then partner with owners on remediation.
- Design, onboard, operate, and tune WAF, rate-limiting, bot-management, DDoS, and edge security controls for high-availability applications and APIs.
- Analyze API telemetry and lead investigation and containment of credential abuse, token misuse, scraping, enumeration, account takeover, authorization bypass, data exfiltration, and business-logic abuse.
- Integrate API security events with SIEM, SOAR, ticketing, and case-management workflows and define coverage, risk, remediation, alert-fidelity, and response-time metrics.
- Automate API and WAF workflows, including validation, policy promotion, alert routing, remediation tracking, rollback, and reporting.
- Lead security design reviews, maintain standards and runbooks, communicate remediation priorities, mentor engineers and analysts, and support high-severity incidents.
Requirements
- Bachelor’s degree in Computer Science, Engineering, Information Technology, Cybersecurity, or a related field, or equivalent practical experience.
- Five or more years of security engineering experience, including at least three years of hands-on API security experience.
- Strong knowledge of REST, GraphQL, API gateways, microservices, HTTP, TLS, JSON, OAuth 2.0, OpenID Connect, JWT, API keys, mutual TLS, service identities, authorization, and common API abuse patterns.
- Hands-on experience with enterprise API security and WAF platforms, security telemetry analysis, attack investigation, false-positive reduction, scripting, and security-platform integrations.
- Experience with at least one major cloud platform—AWS, Microsoft Azure, or Google Cloud Platform—including API gateway, identity, logging, and load-balancing services.
- Strong written and verbal communication skills for explaining technical risk and remediation to technical and non-technical stakeholders.
- Preferred qualifications include Akamai API Security and App & API Protector experience, OpenAPI or GraphQL schema analysis, Terraform and Git-based deployment workflows, and experience supporting global, high-volume digital platforms.
Benefits
- Health and welfare benefits including medical, prescription drug, mental health, dental, vision, and life insurance coverage.
- Eligible for a performance-based bonus.
- Eligible for stock or other equity grants under McDonald’s long-term incentive plan.
- Equal opportunity employer with reasonable workplace accommodations available for qualified individuals with disabilities.
About McDonald's
McDonald’s operates and franchises quick-service restaurants serving burgers, chicken, breakfast items, coffee, and soft drinks to consumers worldwide. The company earns revenue from company-operated restaurants plus franchising fees and real-estate rent paid by independent owner-operators, who run about 95% of its 40,000+ locations across 100+ countries. Founded in 1955 and headquartered in Chicago, it is publicly traded on the NYSE under the ticker MCD.