2 months ago
Base Salary
$109k - $182k/yr
Responsibilities
- Implement and tune runtime API protections across API gateways, service meshes, ingress and edge layers.
- Provide secure API design guidance covering authentication, authorization, validation, error handling, pagination, idempotency, versioning, and least-privilege access.
- Build CI/CD automation for policy-as-code, OpenAPI checks, secrets scanning, SAST, DAST, API testing, and runtime-to-ticket workflows.
- Develop dashboards and analytics from API telemetry and security findings to measure risk, adoption, control effectiveness, and outcomes.
- Define and promote governance for API inventories, ownership, classification, security requirements, exceptions, and control validation.
- Partner with product, platform, SRE, application, and security teams throughout the DevSecOps lifecycle, including planning, threat modeling, design reviews, testing, release readiness, and incident response.
- Map API security controls to NIST, ISO 27001, PCI DSS, FAPI, and OWASP guidance and support audit readiness with control documentation and automated evidence.
- Evaluate, pilot, measure, and scale technologies for API discovery, posture management, runtime detection, and abuse prevention.
Requirements
- 5+ years of related IT and cyber protection experience is desired.
- Master’s degree is preferred, or a bachelor’s degree with equivalent work experience.
- Strong knowledge of API security concepts including OAuth2/OIDC, JWT, session and token handling, scopes and claims, rate limiting, schema validation, and API abuse patterns.
- Practical runtime protection experience with API gateways, WAF/WAAP, service mesh, ingress controllers, or specialized API security platforms.
- Experience building automation in CI/CD and cloud-native environments using policy-as-code, scripting, pipelines, and Git-based workflows.
- Ability to analyze logs, traces, metrics, and other telemetry to detect issues and prioritize actions.
- Working knowledge of secure software development and DevSecOps practices, with the ability to influence engineering outcomes.
- Experience collaborating across security, SRE, platform, and application teams.
- Experience communicating with CISO, CIO, and CTO-level leadership.
- CISSP or another professional cybersecurity certification is desirable.
- Expertise maintaining API protection technologies such as Traceable, Salt Security, or NoName.
- Experience with OpenAPI tooling, API testing, fuzzing, contract testing, threat modeling, abuse-case analysis, financial-industry security controls, and audit evidence is desirable.
Benefits
- Base salary range is $109,000.00–$182,400.00 for employees in New Jersey and New York; ranges may differ in other states.
- Incentive-eligible employees may receive an annual incentive opportunity through cash bonus and/or equity awards.
- Fiserv is an equal opportunity employer and provides reasonable accommodation for applicants with disabilities.
About Fiserv
Fiserv builds payments and financial technology for banks, credit unions, merchants, and billers, including merchant acquiring, card issuing, core banking, and digital banking platforms. It earns revenue through transaction processing, software licensing, and managed services across POS (Clover), bill pay, ACH and card networks, and risk/compliance. The public company is headquartered in Milwaukee, trades on NASDAQ/BMV, acquired First Data in 2019, and serves clients in more than 100 countries.