Principal Product Security Engineer
Fifth Third Bank2 days ago
Remote, United States or Cincinnati, OH, USAStaff+
Base Salary
$97k - $208k/yr
Responsibilities
- Define practical security requirements, acceptance criteria, secure-by-default patterns, validation approaches, and remediation guidance for customer-facing software, APIs, SDKs, integrations, cloud deployments, and distributed services.
- Own Product Security SOC2 readiness items from assessment through stakeholder coordination, evidence collection, technical validation, and verified closure.
- Independently validate remediation using code, configuration, application, API, cloud, infrastructure, and security-control testing.
- Advance software supply chain practices covering dependency governance, SBOMs, artifact integrity, provenance, and code signing.
- Design and build ProdSec360, including its data model, scoring, architecture, ingestion patterns, user experience, roadmap, integrations, and actionable product risk views.
- Use AI-assisted development tools to build software, agentic workflows, and automations that reduce manual Product Security effort.
- Assess complex designs and implementations for trust boundaries, privilege, data exposure, misuse scenarios, resilience, and customer impact.
- Set coverage expectations for architecture reviews, threat modeling, penetration testing, and risk-based application and API testing.
- Create security standards, playbooks, guardrails, technical guidance, and engineering enablement materials, and mentor security and engineering partners.
- Influence engineering, product, and architecture decisions and drive adoption of secure patterns, platform improvements, and ProdSec360.
Requirements
- At least eight years of relevant experience across Product Security, Application Security, Security Engineering, Software Engineering, Cloud Security, Platform Engineering, or related disciplines.
- Hands-on experience building, securing, testing, or operating production software or cloud platforms.
- Ability to investigate security weaknesses using source code, technical designs, test results, configurations, logs, and related evidence.
- Experience translating risk into engineering requirements, secure patterns, prioritization, and remediation guidance.
- Ability to independently own complex security work from definition through coordination, technical validation, and closure.
- Working knowledge of source control, CI/CD, automated testing, cloud deployment, containers, and infrastructure-as-code.
- Strong knowledge of application and API risks, including the OWASP Top 10 and OWASP API Security Top 10.
- Proficiency in at least one programming or scripting language and ability to review application code.
- Hands-on experience with Claude Code, GitHub Copilot, or comparable AI-assisted development tools, including building and testing generated software, agentic workflows, and automations.
- Bachelor’s degree in a related field or an equivalent combination of education and experience.
- Preferred experience includes building or maturing Product Security or Application Security programs and securing financial services, payment products, SaaS platforms, or other high-value transactional systems.
- Preferred expertise includes application security, API security, cloud and container security, software supply chain security, security testing, or DevSecOps.
- Preferred experience includes threat modeling, security assessments, reusable patterns, platform guardrails, Kubernetes, serverless, or AI-enabled development.
- Preferred knowledge includes NIST, OWASP SAMM, the NIST Secure Software Development Framework, or comparable guidance.
- Relevant certifications such as CISSP, CSSLP, CCSP, OSCP, OSWE, GIAC, or a cloud-security credential are preferred.
Benefits
- Comprehensive benefits supporting physical, financial, emotional, and social well-being.
- Eligible for incentive compensation in addition to base salary.
- Virtual position located in Ohio.
Tech Stack
Categories
About Fifth Third Bank
Fifth Third Bank is a regional U.S. financial institution providing commercial and retail banking, consumer lending, credit cards, mortgages, and wealth and asset management to individuals and businesses. It earns interest and fee income from deposits, loans, payments, and investment services delivered through branches, digital channels, and advisors. Founded in 1858 and headquartered in Cincinnati, it is publicly traded as Fifth Third Bancorp (FITB) with a broad footprint across the Midwest and Southeast.