Platform Engineer – API Security

About Trideca

Trideca is a reputable Australian partner specializing in strategy, AI, and digital transformation, collaborating with major enterprises such as NAB, Suncorp, Optus, Medibank, and AGL to deliver impactful technological solutions. Operating from Melbourne and Sydney, Trideca addresses intricate challenges across varied sectors by implementing innovative technologies.

Role Overview

We seek a Platform Engineer focused on API security, responsible for leading and executing the organization's API security initiatives. Reporting to the Head of Technology, Integration Design and Governance, this role involves creating and deploying security policies that shield APIs from external threats by leveraging service mesh technologies aligned with the OWASP API Security Top 10. The position entails managing pipelines that enforce these policies enterprise-wide.

This role merges hands-on engineering with leadership, involving development in AWS, GKE, and Kubernetes environments. The candidate will promote best engineering practices, facilitate knowledge sharing through sessions, and enhance Kubernetes platform operations, Helm deployment strategies, and policy management via GitOps with Argo CD.

Key Responsibilities

• Develop and implement security policies within the service mesh, ensuring adherence to OWASP API Security Top 10 standards.
• Design and establish API security measures including authentication, authorization, and rate limiting, utilizing monitoring tools to safely transition from audit to enforcement without impacting users.
• Oversee pipelines that distribute security policies across the organization and create critical infrastructure on AWS, GKE, and Kubernetes platforms.
• Execute extensive Helm-based changes through GitOps leveraging Argo CD, ensuring safe rollouts, rollback capabilities, and minimal service disturbance.
• Define clear standards for identity management, traffic control, and security to provide consistent and secure defaults across teams.
• Coordinate the migration of live API traffic to the enterprise gateway across multiple teams with zero downtime.
• Lead knowledge-sharing sessions and advocate engineering excellence within the team.

Candidate Profile

• Solid understanding of API security principles, including the OWASP API Security Top 10 framework.
• Experience authoring policy as code using tools like OPA/Rego, Kubernetes Network Policies, or Istio AuthorizationPolicy.
• Comprehensive knowledge of authentication and authorization mechanisms for both services and users in gateway and service mesh contexts.
• Advanced skills in Helm, including managing and delivering large-scale enterprise deployments.
• At least five years of experience within large corporate or enterprise settings, preferably in Platform or Staff Engineer roles, with proven experience in building, testing, and maintaining production services.
• Expertise in Kubernetes (EKS or GKE) and Docker, coupled with a deep grasp of networking architectures.
• Proficiency with Infrastructure as Code using Terraform for large-scale cloud platform management and optimization.
• Experience developing and maintaining CI/CD pipelines and implementing DevSecOps methodologies in corporate environments.
• Strong programming abilities in Golang and Python, including building automated workflows.
• Capability to architect complex cloud-based solutions, balancing detailed implementation and strategic vision.
• Excellent communication skills, collaborative mindset, and the ability to educate and mentor cloud engineers at various levels.
• Degree in Information Technology, Computer Science, or related field, or equivalent hands-on experience.

Desirable Qualifications

• Hands-on experience with Istio and Envoy in production, including gateways, mutual TLS, and AuthorizationPolicy in enterprise settings.
• Certified Kubernetes Administrator (CKA) credential.
• Familiarity with AI-assisted engineering tools and interest in modern automation, code quality, and operational efficiency techniques.

Why Join This Role

• Lead the enterprise's API security program from policy creation to deployment pipelines.
• Engage deeply in security engineering encompassing policy as code, service mesh, GitOps, and cloud infrastructure integration.
• Create substantial impact with policies safeguarding company APIs and establish secure standards embraced by all teams.
• Assume a leadership function by sharing knowledge and mentoring engineers across all skill levels.

About Trideca's Culture and Values

• Commitment to empowering women in technology with tailored mentorship, leadership programs, and inclusive policies.
• Continuous professional growth through diverse learning and development opportunities.
• Flexible work arrangements supporting personal and professional balance.
• Core values include client obsession, teamwork, celebrating diversity, ownership, open dialogue, and fostering a fun workplace.
• Strong dedication to equality and inclusion, encouraging diverse candidates and creating a welcoming work environment.