Staff Security Engineer, API Security

PayPal is hiring a Staff Security Engineer, API Security in Bangalore.

The Company PayPal has been revolutionizing commerce globally for more than 25 years. Creating innovative experiences that make moving money, selling, and shopping simple, personalized, and secure, PayPal empowers consumers and businesses in approximately 200 markets to join and thrive in the global economy. We operate a global, two-sided network at scale that connects hundreds of millions of merchants and consumers. We help merchants and consumers connect, transact, and complete payments, whether they are online or in person. PayPal is more than a connection to third-party payment networks. W

Requirements

• 5+ years relevant experience and a Bachelor’s degree OR Any equivalent combination of education and experience.

Additional Responsibilities & Preferred Qualifications:

In your day-to-day role you will be responsible for:

• Build the end-state API security capability plane: Consolidate today's separate API security lint, gateway traffic visibility, shadow-API detection, and schema (GraphQL/AsyncAPI) security checks into a single, coherent capability that plugs into the org's shared policy-as-code enforcement architecture - the same engine already governing container, static-analysis, and software-composition findings. Design the end state first - this is not a request to bolt on another point tool.
• Take the pre-release API security gate from draft architecture decision to a shipped control, working with the Staff Engineer who owns enforcement architecture to get the gateway-level hard-block policy enforced end to end. This person unblocks stalled decisions - they do not wait for consensus to form on its own.
• Own the dynamic application security testing (DAST) tooling strategy end to end: complete the current tool evaluation into a production migration decision, and execute it.
• Extend API security capability into two domains identified as organizational blind spots - pipeline access & execution control, and systemic artifact consumption verification - treating API security as one instance of the broader supply-chain security problem, not a silo, and enabling them through the shared enforcement architecture rather than a parallel one.
• Be a force multiplier: mentor engineers across the merged team, unblock stuck initiatives, and drive delivery and innovation without waiting to be told what's next. Standard staff-engineer responsibilities and day-to-day routines apply in full - technical leadership, design review, on-call/escalation, sustaining engineering, and maintenance are shared responsibilities like any other staff engineer, not exceptions carved out for this role.
• Shape the Roadmap: Work with the engineering manager and tech leads to shape and prioritize the team's backlog, identify emerging business problems before they become fire drills, and think beyond the current scope of the role rather than just executing what's already been defined.

What do you need to bring:

• Software Engineering: 5+ years building production software with demonstrated staff-level ownership of a platform or system end-to-end, with hands-on coding experience in Python or Go - not just contributing features inside someone else's architecture.
• API Security Engineering: Deep, hands-on expertise in API architecture (REST, GraphQL, AsyncAPI), authZ/authN (OAuth2 scopes, token/session models), and API gateway or service-mesh internals (Envoy-class systems or equivalent).
• AI Knowledge: Working knowledge of how AI and agentic traffic is changing the API threat model - AI-driven API abuse patterns, agent-to-API authentication, and the security implications of agentic commerce - enough to reason about it directly, not just defer to the AI security team.
• Working fluency in policy-as-code approaches to security enforcement and CI/CD security gating - you can write enforcement policy, not just consume someone else's.
• Practical understanding of DAST/SAST tooling internals, deep enough to evaluate and replace an underperforming tool rather than just operate whatever is already in place.
• Security fundamentals across product, cloud, and vulnerability management that go a bit deeper than most - you know why a control exists, not just that it exists.

About PayPal

See the company's official careers page for full details, then apply using the button below.