Cybersecurity Architect - AppSec, Web & APIs

About the role

We are looking for a Cybersecurity Architect specializing in AppSec, Web and API security to join a technological project in León, working with applications, APIs, and environments where security must be integrated from the design stage and throughout the entire development cycle.

• Location: León
• Modality: Hybrid – 60% remote work

What you'll do

Define security controls for web applications and APIs, review designs and authentication/authorization flows, identify vulnerabilities and propose mitigations, integrate security into the development cycle, and coordinate testing, evidence, remediation, and technical documentation.

What we're looking for

• Web application and API security.

• OWASP Top 10 and OWASP API Security.

• Authentication, authorization, session management, input validation, encryption, and access control.

• Protection against vulnerabilities such as XSS, CSRF, SQLi, SSRF, and IDOR.

• Security testing, code review, and definition of secure requirements.

Nice to have

• Experience in DevSecOps, SAST, DAST, and SCA.

• Security in microservices, API Gateway, and WAF.

• Knowledge of OAuth2, OpenID Connect, JWT, and mTLS.

• Experience in Cloud security.

• Knowledge of NIST, ISO 27001, and ENS.

• Certifications such as OSWE, GWAPT, GWEB, CSSLP, CISSP, CEH, CompTIA Security+, AZ-500, SC-200 or Cloud Security certifications.

Education: Degree in Computer Science, Telecommunications, Cybersecurity, or similar. Master's in Cybersecurity, Secure Development, or Security Architecture is valued.

English: Minimum B2 recommended. C1 is valued.

We are looking for a profile with analytical capacity, attention to detail, technical judgment, risk orientation, and the ability to collaborate with development, architecture, and security teams.

If you have solid experience in Application Security, Web Security, and API Security and are interested in learning more about the project, you can contact me or submit your application.