Senior Platform Engineer

Organization- At CommBank, we never lose sight of the role we play in delivering a brighter future for our customers     and supporting our communities. Our focus is to help customers and communities move forward to progress. To make the right financial decisions and achieve their dreams, targets and aspirations. Regardless of where you work within our organization, your initiative, talent, ideas and energy all contribute to the impact that we can make with our work. Together we can build tomorrow’s bank today.

Role Title – Senior Platform Engineer - API Security

Location- Bangalore- Manyata tech Park

Business and team:

Group Security Technology safeguards the organization through innovative cyber, identity and fraud technology. We design, build and run security products that improve security outcomes, enable secure technology adoption and protect the Group's platforms, systems, data and digital assets.

The API Security squad discovers, monitors and protects APIs across the organization. The squad operates enterprise API security capabilities, including Akamai Noname, to maintain visibility of the API estate, assess security posture, monitor runtime behaviour and coordinate action on credible threats and security findings. We partner with application teams, API owners, platform engineering, cloud, architecture and security operations teams.

Impact and Contributions:

As a Senior Platform Engineer in the API Security squad, you will apply deep API security knowledge to operate and enhance the organisation's API security capabilities. You will help discover known and unknown APIs, investigate posture and runtime security issues, validate alerts, prioritise risk and work with API owners to achieve appropriate remediation or risk treatment.

This is a security-first engineering role. Platform engineering, automation and DevOps practices are important enabling capabilities; however, success in the role depends primarily on hands-on API security experience, sound security judgement and the ability to translate technical findings into clear action.

Roles & Responsibilities:

• Investigate API posture and runtime security alerts using HTTP traffic insights, and manage API discovery, monitoring, and inventory lifecycle through the Akamai Noname platform.

• Assess authentication, authorization and common security risks across REST and GraphQL APIs.

• Validate findings, identify false positives and prioritize risks based on severity, exposure and business impact.

• Work with API owners and engineering teams to remediate findings and confirm appropriate closure.

• Configure and improve API security policies, scanning, workflows and integrations.

• Automate workflows and repetitive security activities using APIs and scripting where appropriate.

• Manage API security findings and vulnerabilities through platforms such as ServiceNow and PagerDuty, following established incident response workflows

• Support operational improvements across ServiceNow SecOps dashboards, API governance and control compliance, CMDB data quality and API traffic source integration with Akamai NoName tool.

Essential Skills:

• 8+ years of IT / cybersecurity experience with a strong, demonstrable focus on API security.

• HTTP Expertise: Deep understanding of the HTTP protocol request/response lifecycle, security headers, status codes, and HTTP methods and how these are used to identify and investigate attacks.

• API & Web Vulnerabilities: Strong knowledge of common API security vulnerabilities, abuse cases and controls, including the OWASP API Security Top 10 and relevant web application security risks

• Incident Triage: Experience triaging API security incidents ability to inspect raw HTTP traffic and determine whether a suspicious value is a genuine malicious payload or a false positive.

• Auth & Identity Protocols: Practical working knowledge of OAuth 2.0, OIDC, JWT and mTLS.

• API Security Tooling: Hands-on experience with WAAP or dedicated API security platforms and API gateways like Noname, Salt Security, Traceable, Apigee, Kong, or equivalent.

• REST and GraphQL API security: Understanding of their architecture and their common vulnerability surfaces.

• Analytical Skill: Strong analytical and investigative mindset comfortable working with HTTP logs, API traffic data, SIEM dashboards, and SNOW to reconstruct attack chains.

Supporting Engineering skills

Experience with the following technologies, or equivalent tools and platforms, would be beneficial:

• Infrastructure as Code: Terraform, CloudFormation.

• Cloud platforms: Working knowledge of AWS infrastructure and security concepts.

• CI/CD: GitHub and GitHub Actions.

• Containers and orchestration: Docker and Kubernetes.

• Scripting and automation: Python, Bash or PowerShell.

• Observability: Log aggregation, dashboards, monitoring and alerting.

• Security testing: API or web application penetration testing experience would be advantageous.

Education: Bachelor's or Master's degree in Computer Science, Engineering, Information Technology, Cybersecurity or a related discipline, or equivalent practical experience.