API Security Engineer (AI)

Location: Cambridge, Massachusetts, United States; 70% in-office and 30% remote. Only U.S. persons are eligible due to U.S. export control requirements.

Salary: $121,600–$194,500 per year, with potential discretionary bonus, incentive compensation, or equity.

Company

hirify.global develops mRNA-based therapeutics and vaccines using advances in mRNA science, delivery technology, and manufacturing.

What you will do

• Design, implement, and mature API security capabilities across applications, shared services, integrations, and AI-enabled platforms.
• Evaluate and operationalize technologies for API discovery, posture assessment, traffic monitoring, anomaly detection, and policy enforcement.
• Assess API designs, authentication and authorization patterns, data exposure, service-to-service trust, and other security risks.
• Perform API-focused threat modeling and security assessments for microservices, integrations, and AI-enabled workflows.
• Define secure API practices covering authentication, authorization, rate limiting, schema validation, secrets handling, and service communication.
• Analyze telemetry and findings, identify abuse paths, shadow APIs, and control gaps, and coordinate remediation with engineering and security teams.

Requirements

• U.S. person status is required because the role involves access to export-controlled technology or data; non-U.S. persons cannot be sponsored for an export control license.
• 5+ years of experience in cybersecurity, application security, platform security, or a related engineering discipline, including hands-on API security experience.
• Strong knowledge of API security risks and controls, including authentication, authorization, token handling, rate limiting, input validation, data exposure, and service-to-service trust.
• Experience securing REST, GraphQL, or other modern APIs in cloud-native or distributed environments.
• Experience with API gateways, service meshes, reverse proxies, threat modeling, and technical risk assessments.
• Working knowledge of cloud security, application security, identity, secrets management, logging, workload identities, and agentic access patterns.

Nice to have

• Familiarity with AI-enabled architectures or gateway patterns for access to models, tools, or sensitive data.
• Experience with non-human identity models and emerging agentic security patterns.

Culture & Benefits

• In-person collaboration supported by a 70/30 work model.
• Healthcare and voluntary benefits.
• Fitness, mindfulness, and mental health resources.
• Family planning benefits, including fertility, adoption, and surrogacy support.
• Paid vacation, volunteer days, sabbatical, global recharge days, and year-end shutdown.
• Savings and investment programs plus location-specific perks.