Senior API Security Engineer at Encora (Kuala Lumpur, Malaysia)
Encora· Kuala Lumpur, Malaysia·
Role details
Job description
Key Responsibilities: ● API Logic Security: Hunt for Business Logic vulnerabilities (BOLA/IDOR, Mass Assignment) that traditional firewalls miss. ● Authentication & Authorization: Design and validate OAuth2, OIDC, and JWT implementations to ensure users can only access their own data. ● Attack Simulation: Script automated attacks against the API Gateway to test rate limiting and fraud detection rules. ● Gateway Hardening: Work with the Platform team to configure the API Gateway (Kong, or Azure API Gateway) for maximum security. ● Auth & Partner Integration: Deliver new security design patterns and components for authentication, authorization, SSO, MFA, and Partner security. Standardize how we consume external APIs (Open Banking) and how we secure our own exposed endpoints.
Technical Requirements: ● Strong scripting skills (Python) to automate API attacks. ● Expertise in REST and GraphQL security. ● Deep knowledge of OAuth 2.0 and OpenID Connect (OIDC) flows. ● Experience with API Security tools (Postman, Burp Suite, 42Crunch).
Why work at Encora
- Culture & Recognition: Certified “Great Place to Work” in multiple regions; recognized by Comparably for Career Growth, Best Engineering Team, Best Company for Diversity, and Company Happiness.
- Remote/Hybrid Policy: Flexible work-from-home scheme; remote workers in Mexico receive a monthly allowance of MXN 700 for internet/electricity, plus desk and chair after 3 months. No dress code, pet-friendly environment.
- Perks & Benefits (varies by location):
- Top-of-the-line MacBook Pro
- Unlimited book budget and training/certification support
- Private health insurance (including family) with dental and life insurance
- 12 days paid vacation from day one (Mexico), 5 days PTO, 30 days aguinaldo (mandatory annual bonus)
- Psychotherapy support (12 sessions covered fully)
- Savings fund, grocery vouchers, and snack stations in select offices
- Considerations: Compensation inconsistency across geographies and accounts; project-dependent stability; change fatigue from post-acquisition integration. Candidates should confirm review cycles, salary bands, and account assignment during interviews.