Product Security Principal

Flagstar Bank • New York, NY

1d • $159,075 - $242,112

About The Position

Serves as the embedded security subject matter expert and thought leader for assigned product lines within the product operating model. Partners with technology, business architecture, and risk leaders to foster a security-first culture and help ensure products are secure from design through deployment. Accountable for application-specific security controls, threat modeling, security architecture reviews, secure coding practices, and security testing coordination. Identifies and manages security risks, translates regulatory and policy requirements into actionable control designs, and serves as the escalation point for IT Risk and Cyber domains within the product. Monitors Key Risk Indicators, manages emerging security issues, and drives risk reduction across the product’s technology supply chain.

The position works with product, technology, business, and third-party oversight teams on security architecture, controls, testing, regulatory and audit engagements, vendor risk, incident response, and remediation. It prepares security materials for Technology Review Board reviews and provides guidance to engineering and SRE teams. Minimal travel is required. No unusual physical exertion is involved.

Requirements

• At least 8 years of experience in information security, cybersecurity, or technology risk management, with strong security and technical skills in a regulated organization.
• Experience operating in a 3 Lines of Defense (3LoD) model and translating policy and regulatory requirements into control designs for engineers and architects.
• Ability to communicate effectively and authoritatively with technical and non-technical stakeholders, explaining complex security concepts in simple terms.
• Expert knowledge of application security principles, threat modeling methodologies, and secure software development lifecycle (SSDLC) practices.
• Deep understanding of cloud security architecture, identity and access management, secrets management, and data protection controls.
• Strong understanding of vulnerability assessment, penetration testing, secure code review, and security testing methodologies.
• Ability to translate risks and outcomes into actions that achieve business and technology goals.
• Knowledge of regulatory compliance frameworks, the 3 Lines of Defense model, and control design principles for financial institutions.
• Ability to balance tactical security needs with long-term security architecture goals.
• Excellent written and verbal communication skills.
• Demonstrated ability to influence peers without direct authority.
• Self-motivated learner with experience upskilling on modern technologies and security practices.
• Experience with DevSecOps tooling, CI/CD security integration, code scanning, and container security at build and runtime.
• Knowledge of endpoint security, email security, and workforce technology protection strategies.
• Understanding of third-party risk management, vendor security assessments, and SaaS security considerations.
• Ability to monitor Key Risk Indicators and act with urgency to manage emerging security issues.
• Ability to mentor and guide development teams on secure coding and security best practices.
• Flexibility to adapt to evolving threats and emerging security technologies.
• Ability to collaborate with product, technology, and business colleagues at all levels.
• Understanding of the product operating framework and cross-functional collaboration with Business Architects, Tech Leads, and SRE teams.
• Deep understanding of security incident response, root cause analysis, and corrective action implementation.
• Experience presenting security assessments and recommendations to Technology Review Boards and executive leadership.
• Critical thinking ability to identify hidden security issues and risks in unfamiliar technologies.
• Ability to share security best practices across product and cybersecurity teams.
• Ability to build and maintain effective stakeholder relationships through clear communication, proactive collaboration, and cross-functional insights.
• Ability to build trusted internal or external client relationships, identify needs, and deliver tailored solutions.
• Ability to foster or support a positive work culture and productive work environment.
• No unusual physical exertion is involved.

Nice To Haves

• Undergraduate degree (four years or equivalent).
• Technical understanding of public cloud computing (Azure/AWS), including cloud hardening, data protection controls, resiliency, and access management.
• Experience with APIs and microservices, IAM, secrets management, DevSecOps, and SSDLC.
• Financial services or banking experience; experience in industries with similar risk tolerance is also acceptable.
• CISSP, CISM, or equivalent security certifications.

Responsibilities

• Cultivate a security culture across product, technology, and business teams by embedding threat modeling, security architecture reviews, and secure code practices.
• Own application-specific security requirements, threat modeling, security architecture design, authentication and authorization design, and data classification and handling standards in partnership with Tech Leads and Business Architects.
• Lead security testing, vulnerability assessments, penetration testing coordination, and security validation; track security defect remediation and ensure compliance with secure coding standards.
• Prepare Technology Review Board security artifacts, including Initial Design Review security assessments, Production Release Review security validation, and security incident response plans.
• Monitor Key Risk Indicators, manage emerging security issues, identify root causes and themes, and provide timely resolution recommendations to the BURM and leadership.
• Partner with Third Party Oversight teams to support technology risk management of vendors, particularly for cloud computing, SaaS tools, and emerging technologies.
• Collaborate on business-as-usual audit and regulatory engagements, translating firmwide policy and regulatory requirements into control designs for Software Engineers and SRE teams.
• Serve as the product security thought leader, share best practices between product and cybersecurity teams, and act as the escalation point and subject matter expert for IT Risk and Cyber domains.
• Perform special projects and additional duties and responsibilities as required.
• Maintain regulatory compliance and adhere to internal policies, standards, and controls when performing job responsibilities.

Benefits

• Medical insurance
• Dental insurance
• Vision insurance
• Life insurance
• Disability insurance
• Comprehensive leave program
• Variable incentives, bonuses, commissions, or other awards may be included in total compensation.

What This Job Offers

• Job Type: Full-time
• Career Level: Principal
• Education Level: High school or GED