Senior API Developer/ Security Engineer (Vulnerability / Remediation)

We need to output HTML fragment with sections: headings

for sections like About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Only include sections if posting has real specific content. No job title heading. No metadata like Job ID. Remove boilerplate: application instructions, EEO, etc. Keep substantive info. We need to parse the posting. Content: - Intro: "The position is described below. If you want to apply, click the Apply Now button..." -> remove application instructions. - "After you click Apply Now and complete your application, you'll be invited to create a profile..." -> remove. - "If you already have a profile with us, you can log in to check status." -> remove. - "Need Help? If you have a disability and need assistance with the application, you can request a reasonable accommodation. Send an email to Accessibility (accommodation requests only; other inquiries won't receive a response)." -> remove (EEO/accommodation boilerplate). - "Regular or Temporary: Regular Language Fluency: English (Required) Work Shift: 1st shift (United States of America)" -> This is metadata; we can fold minor metadata into a short

or drop it. Probably we can include a short paragraph with these details? The instruction: "Do NOT put Job ID / requisition numbers as headings — fold minor metadata into a short

or drop it." So we can include a

containing that info. - "Please review the following job description:" -> just intro, can be omitted. - Then description: "This team uses automated API security tools like Akamai, Salt Security and ReadyAPI tools to identify vulnerabilities in running APIs. This Senior Security Engineer will be experienced with API development and/or API security testing tools such as Akamai, API Security, Salt Security, Traceable, Data Theorem, OWASP ZAP (API extensions), SoapUI, ReadyAPI, or Burp Suite. The team partners with application development, DevSecOps, and technology teams to identify, assess, prioritize, and drive remediation of security vulnerabilities across applications, APIs," then "Essential Duties And Responsibilities Following is a summary of the essential functions for this job. Other duties may be performed, both major and minor, which are not mentioned below. Specific activities may change from time to time." Then list of duties (each line starts with a verb). We'll put under

Responsibilities

with

• . Then "Required Qualifications" heading -> we can use

  Requirements

  or

  Qualifications

  . The instruction says use headings like About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. So we have both Requirements and Qualifications sections. We need to decide what content goes where. Typically "Required Qualifications" could go under Requirements. "Preferred Qualifications" could go under Qualifications or Skills. We'll map accordingly. We have "Required Qualifications" list: Bachelor’s degree or equivalent education, training, and work-related experience. Minimum of 7 years of experience in security engineering or related cybersecurity roles. Deep specialized knowledge in cybersecurity principles, theories, and concepts. Proven experience in software development lifecycle security practices. Deep knowledge of threat modeling, security testing, and penetration testing. Experience implementing and managing complex information security technologies. We'll put those under

  Requirements

  as a list. Then "Preferred Qualifications" includes many items: Working knowledge of industry security frameworks and standards, including: NIST SP 800-228 (API Security Guidance) FFIEC guidelines OWASP API Security Top 10 Financial-grade API (FAPI – OpenID Foundation) Strong understanding of API security protocols and frameworks, including OAuth 2.0, OpenID Connect (OIDC), Mutual TLS (mTLS), and JSON Web Tokens (JWT) Experience within banking or financial services environments Proficiency or familiarity with Python scripting Relevant security certifications such as CISSP, OSCP, CEH, or Security+ Experience with cloud platforms such as AWS and/or Microsoft Azure Experience in financial services, cybersecurity, regulated enterprise environments, or platforms with high audit and control requirements. Familiarity with secure tool-calling patterns, API protections, model or prompt change validation, and runtime traceability for AI systems. Working knowledge of cloud-native security patterns, telemetry analysis, and deployment gating for modern engineering teams. Plans and manages own work to meet defined objectives and milestones, seeking feedback, pursuing self-development, and adjusting approaches to improve quality and effectiveness over time. We can put these under

  Qualifications

  (or Skills). Since there is also a Skills heading, we could put technical skills under Skills. But we have many items; we could split: maybe Skills for technical skills like Python, certifications, cloud platforms, etc. Qualifications for experience/education? However the instruction says we can have both Requirements and Qualifications sections. We'll put Required Qualifications under Requirements, Preferred Qualifications under Qualifications. That seems fine. Then "General Description of Available Benefits for Eligible Employees of Truist Financial Corporation:" followed by benefits description. We'll put under

  Benefits

  with
  • for each benefit item. We need to preserve all substantive information; do not invent or summarize away detail. So we need to list each benefit as separate items? The paragraph lists: medical, dental, vision, life insurance, disability, accidental death and dismemberment, tax-preferred savings accounts, and a 401k plan. Also: no less than 10 days of vacation (prorated...), 10 sick days (also prorated), and paid holidays. Also: depending on position and division, may also be eligible for defined benefit pension plan, restricted stock units, and/or a deferred compensation plan. We'll create list items for each. We should not include Pay or Schedule sections because not specified. The posting mentions Work Shift: 1st shift (United States of America) under metadata; we could include that in a short

    maybe under a general info paragraph. But schedule not given as specific hours; we could omit Schedule section because not explicit. The instruction: never create Pay/Schedule/Benefits sections unless the posting actually states them. Benefits are stated, so we include Benefits. Schedule: we have "Work Shift: 1st shift (United States of America)" which is schedule info. That could be considered schedule content. Should we create a Schedule section? The posting states Work Shift: 1st shift (United States of America). That's specific. So we should include a Schedule section with that info. However we must not create a section with filler text; we have actual content. So we can add

    Schedule

    1st shift (United States of America)

    . Also we have Regular or Temporary: Regular Language Fluency: English (Required). That could go under About the role or a general paragraph. We could create an About the role section summarizing the role description. The instruction: Prefer a few substantive sections over many thin ones. We could combine some info into About the role. Let's structure: -

    Regular or Temporary: Regular; Language Fluency: English (Required); Work Shift: 1st shift (United States of America)

    maybe as a brief meta paragraph. -

    About the role

    This team uses automated API security tools like Akamai, Salt Security and ReadyAPI tools to identify vulnerabilities in running APIs. The Senior Security Engineer will be experienced with API development and/or API security testing tools such as Akamai, API Security, Salt Security, Traceable, Data Theorem, OWASP ZAP (API extensions), SoapUI, ReadyAPI, or Burp Suite. The team partners with application development, DevSecOps, and technology teams to identify, assess, prioritize, and drive remediation of security vulnerabilities across applications, APIs.

    -

    Responsibilities

    • Lead the enterprise vulnerability management program for automated API testing, including identification, assessment, prioritization, tracking, and remediation of security vulnerabilities.
    • Performs security testing, and penetration testing tasks for assigned platforms and services, using defined methods to identify and remediate vulnerabilities.
    • Develop risk-based remediation strategies and collaborate with application teams to reduce organizational security exposure.
    • Reviews relevant security threats, tools, and design options for assigned work, and provides input that supports technical plans and priorities for the job area.
    • Perform triage and validation of security findings to reduce false positives and improve remediation effectiveness.
    • Design, implement, and maintain automated API security testing capabilities within CI/CD pipelines.
    • Implements and updates security baselines, guardrails, and control configurations for systems and applications within the area of responsibility, helping maintain regulatory and policy compliance.
    • Shares knowledge and best practices with technical teammates, offering informal guidance and support during code reviews, design discussions, and pairing sessions.
    -

    Requirements

    • Bachelor’s degree or equivalent education, training, and work-related experience.
    • Minimum of 7 years of experience in security engineering or related cybersecurity roles.
    • Deep specialized knowledge in cybersecurity principles, theories, and concepts.
    • Proven experience in software development lifecycle security practices.
    • Deep knowledge of threat modeling, security testing, and penetration testing.
    • Experience implementing and managing complex information security technologies.
    -

    Qualifications

    • Working knowledge of industry security frameworks and standards, including: NIST SP 800-228 (API Security Guidance), FFIEC guidelines, OWASP API Security Top 10, Financial-grade API (FAPI – OpenID Foundation).
    • Strong understanding of API security protocols and frameworks, including OAuth 2.0, OpenID Connect (OIDC), Mutual TLS (mTLS), and JSON Web Tokens (JWT).
    • Experience within banking or financial services environments.
    • Proficiency or familiarity with Python scripting.
    • Relevant security certifications such as CISSP, OSCP, CEH, or Security+.
    • Experience with cloud platforms such as AWS and/or Microsoft Azure.
    • Experience in financial services, cybersecurity, regulated enterprise environments, or platforms with high audit and control requirements.
    • Familiarity with secure tool-calling patterns, API protections, model or prompt change validation, and runtime traceability for AI systems.
    • Working knowledge of cloud-native security patterns, telemetry analysis, and deployment gating for modern engineering teams.
    • Plans and manages own work to meet defined objectives and milestones, seeking feedback, pursuing self-development, and adjusting approaches to improve quality and effectiveness over time.
    -

    Benefits

    • Medical insurance
    • Dental insurance
    • Vision insurance
    • Life insurance
    • Disability insurance
    • Accidental death and dismemberment insurance
    • Tax-preferred savings accounts
    • 401(k) plan
    • At least 10 days of vacation (prorated based on date of hire and full‑time/part‑time status)
    • 10 sick days (prorated)
    • Paid holidays
    • Depending on position and division, may also be eligible for a defined benefit pension plan, restricted stock units, and/or a deferred compensation plan
    -

    Schedule

    1st shift (United States of America)

    We should not include any boilerplate like EEO, etc. Check that we didn't repeat job title as heading. Good. We need to