API Standards & Compliance Lead

About the role

The API Standards & Compliance Lead will define, implement, and enforce enterprise-wide API governance frameworks that ensure consistency, security, and scalability across all APIs. This role focuses on establishing API design standards, lifecycle governance, and compliance policies aligned with industry best practices and regulatory requirements.

Responsibilities

• Define and maintain enterprise-wide API design and governance policies aligned with architecture principles and industry standards (OpenAPI, REST, GraphQL).
• Establish naming conventions, versioning guidelines, backward compatibility expectations, deprecation/retirement policies, and documentation standards.
• Run the API Governance Board (reviews, approvals, waivers) and maintain the governance operating model.
• Author and maintain reference architecture, standards playbooks, and reusable policy templates.
• Design and oversee API onboarding workflows via the Developer Portal, ensuring proper documentation, cataloging, and discoverability.
• Define governance processes integrated with Apigee X for publishing, runtime policies, and analytics.
• Implement governance for security patterns (OAuth2, JWT, JWKS, mTLS) using Apigee X and Ping Identity.
• Align APIs to regulatory requirements (e.g., Open Banking, PSD2, HIPAA, GDPR) and enterprise security standards.
• Partner with Risk, Compliance, and Security Engineering to define control objectives, evidence, and auditability.
• Collaborate with the API Gateway and DevEx teams to optimize portal usability, API discoverability, and policy adoption.
• Define and track governance KPIs (e.g., % APIs compliant, time-to-approve, policy adoption rates, security defect trends).
• Partner with platform teams to integrate policy-as-code checks (linting, contract validation, auth enforcement) into CI/CD.

Requirements

10+ years in IT, including strong API development/governance experience, with 5+ years in API governance or platform leadership roles at an enterprise scale.

• Deep familiarity with OpenAPI/Swagger, REST fundamentals, GraphQL design considerations, and API lifecycle management.
• Hands-on experience with security standards (OAuth2, JWT, JWKS, mTLS) and regulatory frameworks (Open Banking/PSD2, HIPAA, GDPR).
• Experience with Apigee X on GCP (or similar API management platforms) from a governance/architecture perspective.
• GCP certifications (e.g., Professional Cloud Architect); Apigee certifications.
• Experience with Ping Identity integration and enterprise IAM.
• Familiarity with GCP services (Cloud Armor, IAM, VPC networking) and platform security controls.
• Background in DevSecOps, CI/CD automation, and policy-as-code for API compliance.
• Experience improving API portals, catalogs, and developer experience, including analytics-driven enhancements.

Qualifications

Strong communication, stakeholder management, and change management skills.

Skills

• Demonstrated ability to write clear policies, standards, and procedures.
• Facilitate governance forums.
• Drive alignment across stakeholders.

Benefits

Medical, dental, vision, life, disability, and other insurance plans; ESPP (employee stock purchase program); 401K program with company match; HSA (Health Savings Account on the HDHP plan); SupportLinc Employee Assistance Program (EAP) with up to 8 free counseling sessions; corporate discount savings program and other discounts; on-demand training program, certification prep, and a library of technical and leadership courses/books/seminars; certification discounts and other perks to associations like CompTIA and IIBA; dedicated customer service team for questions about benefits and other resources; certified Career Coach.

Pay

Details TBD

Schedule

Hybrid: 4 days onsite, 1 Remote