Posted 22 Jun 2026 · Engineering
Job description
Key Responsibilities:
● API Logic Security: Hunt for Business Logic vulnerabilities (BOLA/IDOR, Mass
Assignment) that traditional firewalls miss.
● Authentication & Authorization: Design and validate OAuth2, OIDC, and JWT
implementations to ensure users can only access their own data.
● Attack Simulation: Script automated attacks against the API Gateway to test rate limiting
and fraud detection rules.
● Gateway Hardening: Work with the Platform team to configure the API Gateway (Kong,
or Azure API Gateway) for maximum security.
● Auth & Partner Integration: Deliver new security design patterns and components for
authentication, authorization, SSO, MFA, and Partner security. Standardize how we
consume external APIs (Open Banking) and how we secure our own exposed endpoints.
Technical Requirements:
● Strong scripting skills (Python) to automate API attacks.
● Expertise in REST and GraphQL security.
● Deep knowledge of OAuth 2.0 and OpenID Connect (OIDC) flows.
● Experience with API Security tools (Postman, Burp Suite, 42Crunch).
Pay, skills & work eligibility
Compensation
A clear compensation amount was not identified. Ask the employer for the range, currency, pay period and whether it covers base pay or total compensation.
Location, eligibility & working hours
- Listed work location
- Kuala Lumpur
- Visa sponsorship
- Not stated clearly
- Relocation support
- Not stated clearly
- Working hours / time zone
- Not stated clearly
- Work authorization wording
- ● Authentication & Authorization: Design and validate OAuth2, OIDC, and JWT
Remote does not automatically mean work from any country. A location match does not confirm work authorization, sponsorship or relocation eligibility.
Requirements at a glance
Named skills identified in the listing. A mention is not always a requirement; read the full description and employer conditions.