IND Lead Engineer, Security - Web Application and API Protection Security Engineer

IND Lead Engineer, Security - GCC041

We’re determined to make a difference and are proud to be an insurance company that goes well beyond coverages and policies. Working here means having every opportunity to achieve your goals – and to help others accomplish theirs, too. Join our team as we help shape the future.

Job Posting: Web Application and API Protection (WAAP) Engineer

We are seeking a highly skilled Web Application and API Protection (WAAP) Engineer to join our Information Security team. This role is responsible for designing, implementing, and managing enterprise-scale protections for web applications and APIs. The ideal candidate will have deep expertise in web application security, API security, web application firewalls (WAF), bot mitigation, DoS protection, and modern cloud-native security architectures.

As a WAAP Engineer, you will work closely with application development, cloud engineering, network security, and cybersecurity teams to protect critical business services from evolving threats while enabling secure digital innovation.

Provide operational support and maintenance for The Hartford’s enterprise WAF and API security platforms

Design, deploy, and maintain WAAP solutions including Threat Detection and Prevention

Vulnerability Detection and Prevention

Bot Management and Account Protection

DoS mitigation technologies

Develop and manage security policies to protect web applications, mobile applications, and APIs from OWASP Top 10 and OWASP API Top 10 threats

Monitor, analyze, and respond to application-layer attacks, malicious bot activity, and API abuse

Conduct rule tuning, false-positive analysis, and security policy optimization

Support cloud-native WAAP deployments across environments such as AWS, Azure, GCP

Create dashboards, metrics, and reports demonstrating security posture, attack trends, and risk reduction

Stay current on emerging web, API, and application security threats, vulnerabilities, and industry best practices

Participate in security incident response activities involving web applications and APIs

Required Qualifications

Bachelor's degree in Information Security, Computer Science, Cybersecurity, or related field (or equivalent experience)

3+ years of experience in application security, web security, network security, or a related cybersecurity role

Hands-on experience with WAAP technologies such as Akamai WAF & API Security

Apigee API Management

AWS WAF

Google Cloud Armor

Strong understanding of OWASP Top 10

OWASP API Security Top 10

Authentication and Authorization (OAuth2, OIDC, SAML)

REST, GraphQL, and SOAP APIs

TLS/SSL

SPA, MPA and Web Application architectures

Experience with API discovery, API inventory management, and API security monitoring

Experience with SIEM, security monitoring, and log analysis platforms

Preferred Qualifications

Experience implementing enterprise WAF and API security programs

Knowledge of Secure Software Development Lifecycle (SSDLC) practices

Industry certifications such as: CISSP

AWS Certified Security Specialty

About Us | Our Culture | What It’s Like to Work Here