Staff Software Engineer

Description

Recognized as the No. 1 site trusted by real estate professionals, Realtor.com® has been at the forefront of online real estate for over 25 years, connecting buyers, sellers, and renters with trusted insights and expert guidance to find their perfect home. Through its robust suite of tools, Realtor.com® not only makes a significant impact on the real estate industry at large, but for consumers, navigating the biggest purchase they will make in their life, by providing a user experience that is easy to use, easy to understand, and most of all, easy to make decisions.

Join us on our mission to empower more people to find their way home by breaking barriers to entry, making the right connections, and building confidence through expert guidance.

About the Role:

Our apps and websites run on APIs. A public API gateway and a federated GraphQL platform carry billions of requests a month, covering listings, search, sign-in, saved homes, and the leads we send to agents. As the founding Staff engineer for API security on our new Edge and API Security team, you'll set the technical direction for how we protect them. You'll decide how every API is authenticated, which operations are allowed, how abuse is detected and stopped, and how new APIs ship secure by default. You'll work hands-on and lead through influence across platform, product, identity and security teams, with leadership backing and a clear mandate.
Top Reasons to Apply:

• A Key technical role on a high impact team. You'll shape its architecture, standards and hiring from day one.
• Real scale: billions of API and GraphQL requests a month, and abuse that ranges from scraping to account takeover.
• Direct business impact: your work protects consumer accounts, the quality of leads sent to agents, and the data that powers our business.
• A modern stack, all managed as code: an API gateway, Apollo GraphQL Federation, Kubernetes and policy-as-code.
• Room to apply automation and AI to detection and response.
• Leadership that wants guardrails built into the platform, not more tickets.

What You'll Do:

• Own the API security architecture across the API gateway and the GraphQL platform, and set the multi-quarter roadmap.
• Define and enforce an authentication standard for every public API, and lead the migration of existing unauthenticated APIs to it, working with the owning teams.
• Secure GraphQL end to end: approved-operation lists and persisted queries, depth and cost limits, field-level authorization, and safe schema change.
• Protect high-value flows such as sign-in, registration, account and lead submission against credential stuffing, account takeover, scraping and fake submissions.
• Make "secure by default" real, using admission policies, CI checks and gateway policies that stop an unprotected API from reaching production.
• Build detection and alerting on API abuse, so attacks surface in minutes, not in downstream business reports.
• Lead response to API attacks and abuse, and turn every incident into a lasting fix.
• Mentor engineers, set API security review standards, and help hire the rest of the team.

What You'll Bring:

• 8+ years in security, platform or backend engineering, with 5+ years focused on API or application security at large scale.  Bachelor's degree or equivalent experience.
• Deep knowledge of API security: OAuth 2.0/OIDC, JWT, API keys and client identity, mTLS, and the OWASP API Security Top 10.
• Hands-on GraphQL security experience: federation, persisted queries and safelists, query cost analysis, introspection controls, and authorization patterns.
• Experience operating an API gateway (such as Tyk, Kong or AWS API Gateway), including policy design, rate limiting and key management.
• Kubernetes and policy-as-code experience (ValidatingAdmissionPolicy, OPA or Kyverno), plus infrastructure as code and CI/CD.
• Strong programming skills in at least one language such as Go, TypeScript or Python, and comfort reading and changing service code.
• Experience with abuse and fraud patterns: credential stuffing, account takeover, scraping and bot-driven form abuse, and how to detect them with logs and SQL.
• A record of leading multi-team technical initiatives, and of explaining risk to executives in business terms.

Nice to Have:

• Experience with Apollo GraphQL Federation and its router, or with Auth0 or similar identity platforms.
• Experience with mobile app attestation (App Attest, Play Integrity) or API bot protection.
• Experience building a security function or team from scratch.

How We Reward You:

Realtor.com is committed to investing in the health and wellbeing of our employees and their families. Our benefits programs include, but are not limited to:

• Inclusive and Competitive medical, Rx, dental, and vision coverage
• Family forming benefits
• 13 Paid Holidays
• Flexible Time Off
• 8 hours of paid Volunteer Time off
• Immediate eligibility into Company 401(k) plan with 3.5% company match
• Tuition Reimbursement program for degreed and non-degreed programs
• 1:1 personalized Financial Planning Sessions
• Student Debt Retirement Savings Match program
• Free snacks and refreshments in each office location
• Do the best work of your life at Realtor.com

Here, you’ll partner with a diverse team of experts as you use leading-edge tech to empower everyone to meet a crucial goal: finding their way home. And you’ll find your way home too. At Realtor.com®, you’ll bring your full self to work as you innovate with speed, serve our consumers, and champion your teammates. In return, we’ll provide you with a warm, welcoming, and inclusive culture; intellectual challenges; and the development opportunities you need to grow.

Diversity is important to us, therefore, Realtor.com® is an Equal Opportunity Employer regardless of age, color, national origin, race, religion, creed, gender, sex, sexual orientation, gender identity and/or expression, marital status, status as a disabled veteran and/or veteran of the Vietnam Era or any other characteristic protected by federal, state or local law. In addition, Realtor.com® will provide reasonable accommodations for otherwise qualified disabled individuals.

We may use artificial intelligence (AI) tools to support parts of the hiring process, such as reviewing applications, analyzing resumes, or assessing responses. These tools assist our recruitment team but do not replace human judgment. Final hiring decisions are ultimately made by humans. If you would like more information about how your data is processed, please contact us.