Position Title:              Senior Developer, APIs

Department:                Technology - Engineering - Digital Experience (DEx)

Reports to (Title):        Head of Engineering

Level/Sub-Level:Operations Level / Professional​ 

☒Exempt                     ☐ Non-Exempt

POSITION PURPOSE

The Sr. Developer, APIs is responsible for designing, building, and maintaining the API platform that supports YPO's member ecosystem, chapter operations, and agentic AI platform.

This role owns the technical implementation of APIs that sit at the core of the digital experience and works closely with Product, Data Architecture, IT, and Security to deliver scalable, secure, and well-governed API solutions.

The role requires strong backend engineering expertise, a high standard for API quality, and the ability to translate complex integration requirements into maintainable, production-grade systems within an event-driven, domain-aligned, serverless-first architecture.

Your API Portfolio: You will own the engineering implementation of three core API domains:

Members API

Stable, semantic endpoints exposing member profile, identity, peer discovery, and graph relationships. The foundation of member experience.

Chapters API

APIs powering chapter management, forum operations, event discovery, and role-based data access across YPO's global regional structure.

Agentic Ecosystem APIs

Governed API contracts for AI agents (Peer Discovery, Event Discovery) built on OpenAI + RAG and Google Gemini. Agents consume only approved APIs. Agent reasoning must always be surfaceable.

PRIMARY RESPONSIBILITIES

• Design and implement production-grade RESTful and GraphQL APIs deployed via AWS API Gateway that are stable, semantic, and decoupled from vendor-specific backend schemas.

• Ensure all APIs conform to YPO's canonical ontology and global member graph. No endpoint may directly expose Salesforce object structures. APIs must map to govern entity definitions maintained in the enterprise data dictionary.

• Design APIs to operate within an event-driven architecture leveraging CDC, pub/sub messaging (Kafka and AWS EventBridge), and idempotent patterns.

• Apply Domain-Driven Design (DDD) principles bounded contexts, ubiquitous language, and domain events to ensure API boundaries reflect business domains, not implementation details.

• Adopt a serverless-first approach using AWS Lambda, Step Functions, and EventBridge where appropriate, selecting stateful services only when serverless patterns are genuinely insufficient.

• Write clean, well-tested, and well-documented code across the Members, Chapters, and Agentic Ecosystem API domains.

• Define and enforce data models, versioning standards, authentication flows (Auth0 / Okta / OAuth 2.0), and integration patterns from first principles.

• Apply performance-aware design intentional pagination, caching strategies, query constraints, and rate-limiting so APIs scale safely under real-world load.

• Every API decision must reinforce member trust through privacy-first architecture, consent enforcement, and transparent data usage.

• Ensure every API response includes provenance and explanation metadata, so agent reasoning is always surfaceable to the member.

• Implement the API governance layer that controls how YPO's AI agents (Peer Discovery, Event Discovery) interact with member data on OpenAI + custom RAG and Google Gemini.

• All agent-facing APIs must support structured retrieval, citation-ready provenance fields, consent-aware filtering, and deterministic fallback.

• Build and maintain kill-switch-capable API boundaries that prevent agents from ever consuming raw member data outside approved contracts.

• Instrument agent API integrations with feedback loop mechanisms hallucination rates, task success rates, and cost-per-outcome metrics must be observable and attributable to specific API behaviors.

• Collaborate with data science and ML teams to translate agentic data flow requirements into governed, tested API contracts.

• Own the full API lifecycle: development, testing, documentation, versioning, deprecation, and migration planning. Every phase requires an explicit decision, no implied continuation.

• Establish and maintain engineering standards for API versioning, backward compatibility, and breaking-change policy.

• Build and maintain sandbox environments, integration test suites, and automated contract tests for every endpoint in the portfolio.

• Working with Engineering leads to ensuring reliable CI/CD pipelines, deployment automation, observability via Datadog, alerting, and uptime SLAs. All infrastructure changes must be deployed via Infrastructure as Code (Terraform or AWS CDK) manual console changes in production are not permitted.

• Design and enforce IAM boundary design using least-privilege principles, permission boundaries, and Service Control Policies (SCPs) ensuring API-layer identities and Lambda execution roles cannot exceed governed data access boundaries.

• Operate within and contribute to YPO's multi-account AWS strategy (AWS Organizations, Control Tower) understanding how workload isolation, environment separation, and cross-account roles affect API deployment patterns and security boundaries.

• All cloud infrastructure must be defined and maintained as code using Terraform or AWS CDK this is a hard requirement, not optional practice.

• Produce and maintain clear API documentation, for example queries, and troubleshooting guides so internal teams can self serve without escalation.

• Support technical onboarding for new product teams and integration partners, ensuring APIs are discoverable, stable, and easy to consume.

• Identify and address developer friction proactively issues must never surface only via member complaints or downstream team escalations.

• Act as a technical resource for Engineering peers consuming the Members, Chapters, and Agentic APIs.

• Work closely with Data Architecture to ensure APIs maintain stable semantic meaning over evolving backend schemas frontend experience must be decoupled from vendor-specific fields.

• Partner with IT and Security to enforce role-based access, chapter-scoped data boundaries, and member consent policy (Auth0 / Okta, OneTrust, GDPR, CCPA).

• Collaborate with Product teams and the Sr. Product Manager, Technical to translate requirements and API specifications into production implementations.

• Evaluate and integrate third-party technologies (Elasticsearch, Kafka / AWS EventBridge, Search Orchestration Service) that enhance YPO's member ecosystem.

How We Measure Success

• API Reliability APIs meet defined uptime SLAs; issues detected proactively via Datadog not reported by members.

• Code Quality New endpoints ship with full test coverage; zero undocumented breaking changes; lifecycle plans in place for every endpoint.

• Developer Experience Internal teams can serve from documentation; integration timelines reduced; escalations minimized.

• Delivery Roadmap milestones delivered on time, with acceptance test coverage and passing CI/CD pipelines.

• Agent Safety Zero agentic API calls bypass the governance layer; kill-switch tested and functional for all agent endpoints.

• Explainability Every API response includes provenance and explanation metadata; no result feels like a black box.

• Observability All agent integrations emit hallucination rates, task success, and cost-per-outcome metrics traceable to specific API behaviors.

• IaC Compliance All infrastructure changes are deployed via Terraform or CDK; no manual console changes in production.

SKILLS

• Ability to work collaboratively in a multi-cultural organization with international members, helping them achieve excellence in voluntary roles for YPO initiatives.  

• Excellent interpersonal skills, including strong diplomacy skills with the ability to build meaningful relationships with all levels of associates, members and vendors. Adaptable, insightful, empathetic and reliable. Great sense of humor and humility.  

• Resourceful and able to work independently with initiative and common sense. Effective time management, organization and prioritization skills with the ability to focus on varied projects simultaneously.  

• Possesses a distinct global mindset, sensitive to local and international customs and protocols.   

• Demonstrate empathy through active listening and asking the right questions to find the source of an issue.  

• Able to identify problems, research alternatives, provide solutions and/or resolve issues in a timely manner. Anticipates member/internal client needs and delivers with clarity.  

• Analytical thinker with ability influence and guide processes with appropriate approach and execution. Natural curiosity and desire to learn more; proficiency and interest in applying new technologies and tools.  

• Excellent verbal and written communication skills, including proof reading, with a meticulous attention to detail. Adjust communication style appropriately to the audience.   

• Professional presence, appearance, and stature to interact easily with YPO members, C-level executives and peers at all levels within the organization.   

• Strong ability to translate complex security risks into clear business decisions.

• Demonstrated ability to work collaboratively across product, engineering, and global teams.

• Analytical thinker with strong architectural judgment and risk-based decision making.

• High degree of discretion and integrity in handling confidential information.

• Ability to operate independently in fast-moving, ambiguous environments.

EXPERIENCE/BACKGROUND

• 5+ years of hands-on experience in security engineering, with at least 3 years focused on cloud infrastructure security (AWS, Azure, and/or GCP).

• Experience integrating security tooling into CI/CD platforms (GitHub Actions, Azure DevOps, GitLab CI, Jenkins, etc.).

• Experience securing AI/ML infrastructure, including model APIs, data pipelines, vector databases, and inference endpoints.

• Experience with AI technologies, ability to monitor LLM usage, audit model access controls, etc.

• API abuse detection across the entire SDLC.

• Strong experience with IaC tools (Terraform, CloudFormation, ARM).

• Familiarity with container security and Kubernetes environments.

• Experience with SAST, DAST, SCA, and dependency scanning tools.

• Proficiency in Python or equivalent scripting language.

• Strong knowledge of IAM, encryption, OAuth/OIDC, RBAC, and secure cloud architecture principles.

• Understanding of compliance & security frameworks (SOC 2, ISO 27001, NIST).

• Exposure to mobile application security on native iOS and/or Android platforms, including API security, token management, and mobile threat defense.

EDUCATION/TRAINING/CERTIFICATION

• Bachelor’s degree in computer science, Information Security, or related field (or equivalent experience).

• Security certifications are highly desirable (AWS, Azure, GCP, CISSP, CCSP, GIAC, etc.).

PHYSICAL REQUIREMENTS

• Ability to work flexible and/or extended hours as needed to accommodate members and team members in multiple time zones.

• Willingness and ability to travel, domestically and internationally, without restrictions, approximately 5-10% per year.