Lead Information Security Consultant - API Security & Governance

U.S. Bank; Northern (KY); Hybrid; USD 127,000 - 149,000; Full time

Benefits offered by this job

Healthcare benefits

401(k) retirement plan

Paid time off

Job summary

U.S. Bank is seeking a Lead Information Security Consultant focused on API Security & Governance to strengthen API security across the enterprise. The role partners with security, risk, architecture, and engineering teams to establish standards and drive secure API adoption.

The candidate will lead threat modeling, security reviews, architecture assessments, and risk evaluations, while staying current on emerging API threats and industry best practices.

Qualifications

• 10+ years of experience in Information Security, Application Security, API Security, Security Architecture, or a related field.
• Deep expertise in API Security and Application Security principles, frameworks, and best practices.
• Experience developing, implementing, and enforcing security standards, governance models, controls, and policies.
• Strong understanding of secure API design, authentication, authorization, and risk management.
• Experience performing threat modeling, security reviews, architecture assessments, and risk evaluations.
• Proven ability to assess and improve an organization's API security posture.
• Experience partnering with security, risk, architecture, business, and engineering stakeholders across large enterprise environments.
• Strong understanding of security frameworks, regulatory requirements, and compliance considerations.
• Prior hands-on technical experience with application development, APIs, or API technologies.
• Ability to influence decision-making and drive security initiatives without direct authority.

Responsibilities

• Lead the development, maintenance, and evolution of enterprise API security standards, controls, and governance practices.
• Assess and improve the bank's overall API security posture through security reviews, risk assessments, and control evaluations.
• Provide guidance on secure API architecture, authentication, authorization, encryption, threat protection, monitoring, and lifecycle management.
• Partner with Information Security, Technology Risk, Enterprise Architecture, and engineering teams to identify and mitigate API security risks.
• Conduct architecture reviews, threat modeling exercises, and security assessments for API-enabled applications and platforms.
• Define and promote API security best practices, reusable security patterns, and governance frameworks across the enterprise.
• Influence technology teams to adopt secure-by-design API development and implementation practices.
• Support regulatory, compliance, audit, and risk management activities related to API and Application Security.
• Serve as a trusted advisor and subject matter expert for API Security and Application Security initiatives.
• Stay current on emerging API threats, vulnerabilities, technologies, and industry best practices to continuously improve enterprise security capabilities.
• Collaborate with platform teams supporting Apigee, GraphQL, AI APIs, AWS API Gateway, and other API technologies to ensure security requirements are consistently applied.
• Drive alignment between business objectives, security requirements, and enterprise technology standards.

Skills

API Security

Security Architecture

Security Standards

Threat Modeling

Risk Assessments

Governance & Compliance

Cross-functional Collaboration

Security Reviews

Security Policy Development

Influence without Authority

Tools

Apigee

AWS API Gateway

GraphQL Gateways

Kong

MuleSoft

Job description

At U.S. Bank, we're on a journey to do our best. Helping the customers and businesses we serve to make better and smarter financial decisions and enabling the communities we support to grow and succeed. We believe it takes all of us to bring our shared ambition to life, and each person is unique in their potential. A career with U.S. Bank gives you a wide, ever-growing range of opportunities to discover what makes you thrive at every stage of your career. Try new things, learn new skills and discover what you excel at - all from Day One.

Job Description

Location expectations: This role requires working from a U.S. Bank location three (3) or more days per week. US Bank is seeking a Lead Information Security Consultant - API Security & Governance to help strengthen and mature API security across the enterprise. This individual will serve as a senior subject matter expert responsible for evaluating and improving the organization's API security posture while ensuring API platforms, programs, and practices align with security standards, regulatory requirements, and industry best practices. This person will partner closely with Information Security, Technology Risk, Enterprise Architecture, business lines, and technology teams to define security standards, establish governance frameworks, assess risk, and drive secure API adoption across the bank.

Main Responsibilities

• Lead the development, maintenance, and evolution of enterprise API security standards, controls, and governance practices.
• Assess and improve the bank's overall API security posture through security reviews, risk assessments, and control evaluations.
• Provide guidance on secure API architecture, authentication, authorization, encryption, threat protection, monitoring, and lifecycle management.
• Partner with Information Security, Technology Risk, Enterprise Architecture, and engineering teams to identify and mitigate API security risks.
• Conduct architecture reviews, threat modeling exercises, and security assessments for API-enabled applications and platforms.
• Define and promote API security best practices, reusable security patterns, and governance frameworks across the enterprise.
• Influence technology teams to adopt secure-by-design API development and implementation practices.
• Support regulatory, compliance, audit, and risk management activities related to API and Application Security.
• Serve as a trusted advisor and subject matter expert for API Security and Application Security initiatives.
• Stay current on emerging API threats, vulnerabilities, technologies, and industry best practices to continuously improve enterprise security capabilities.
• Collaborate with platform teams supporting Apigee, GraphQL, AI APIs, AWS API Gateway, and other API technologies to ensure security requirements are consistently applied.
• Drive alignment between business objectives, security requirements, and enterprise technology standards.

Must Have Skills

• 10+ years of experience in Information Security, Application Security, API Security, Security Architecture, or a related field.
• Deep expertise in API Security and Application Security principles, frameworks, and best practices.
• Experience developing, implementing, and enforcing security standards, governance models, controls, and policies.
• Strong understanding of secure API design, architecture, authentication, authorization, and risk management.
• Experience performing threat modeling, security reviews, architecture assessments, and risk evaluations.
• Proven ability to assess and improve an organization's API security posture.
• Experience partnering with security, risk, architecture, business, and engineering stakeholders across large enterprise environments.
• Strong understanding of security frameworks, regulatory requirements, and compliance considerations.
• Prior hands-on technical experience with application development, APIs, or API technologies.
• Ability to influence decision-making and drive security initiatives without direct authority.

Nice to Have Skills

• Experience with API gateway technologies such as Apigee, AWS API Gateway, GraphQL gateways, Kong, MuleSoft, or similar platforms.
• Knowledge of the OWASP API Security Top 10 and common API attack vectors.
• Experience with OAuth 2.0, OpenID Connect (OIDC), JWT, mTLS, API threat protection, and modern authentication frameworks.
• Experience supporting API governance programs within financial services or other highly regulated industries.
• Exposure to API penetration testing, security testing methodologies, and vulnerability management practices.
• Knowledge of cloud-native application architectures, microservices, and distributed systems.
• Experience developing enterprise security reference architectures and reusable security patterns.
• Security certifications such as CISSP, CSSLP, GWAPT, or equivalent.
• Experience securing modern API ecosystems, including AI APIs and emerging API technologies.

Benefits

• Healthcare (medical, dental, vision)
• Basic term and optional term life insurance
• Short-term and long-term disability
• Pregnancy disability and parental leave
• 401(k) and employer-funded retirement plan
• Paid vacation (from two to five weeks depending on salary grade and tenure)
• Up to 11 paid holiday opportunities
• Adoption assistance
• Sick and Safe Leave accruals of one hour for every 30 worked, up to 80 hours per calendar year unless otherwise provided by law
• Review our full benefits available by employment status here.

U.S. Bank is an equal opportunity employer.

We consider all qualified applicants without regard to race, religion, color, sex, national origin, age, sexual orientation, gender identity, disability or veteran status, and other factors protected under applicable law.

U.S. Bank participates in the U.S. Department of Homeland Security E-Verify program in all facilities located in the United States and certain U.S. territories. The E-Verify program is an Internet-based employment eligibility verification system operated by the U.S. Citizenship and Immigration Services. Learn more about the E-Verify program.

Pay Range: $126,820.00 - $149,200.00

U.S. Bank will consider qualified applicants with arrest or conviction records for employment. U.S. Bank conducts background checks consistent with applicable local laws, including the Los Angeles County Fair Chance Ordinance and the California Fair Chance Act as well as the San Francisco Fair Chance Ordinance. U.S. Bank is subject to, and conducts background checks consistent with the requirements of Section 19 of the Federal Deposit Insurance Act (FDIA). In addition, certain positions may also be subject to the requirements of FINRA, NMLS registration, Reg Z, Reg G, OFAC, the NFA, the FCPA, the Bank Secrecy Act, the SAFE Act, and/or federal guidelines applicable to an agreement, such as those related to ethics, safety, or operational procedures. Applicants must be able to comply with U.S. Bank policies and procedures including the Code of Ethics and Business Conduct and related workplace conduct and safety policies.

Posting may be closed earlier due to high volume of applicants.

At U.S. Bank, we're on a journey to do our best. Helping the customers and businesses we serve to make better and smarter financial decisions and enabling the communities we support to grow and succeed. We believe it takes all of us to bring our shared ambition to life, and each person is unique in their potential. A career with U.S. Bank gives you a wide, ever-growing range of opportunities to discover what you excel at - all from Day One.