Product Manager - Secure App Delivery & Risk

Bank of America; Denver (CO); On-site; USD 135,000 - 217,000; Full time

Job summary

Bank of America is seeking a Product Manager - Tech Delivery to partner with BISO and CIOs to drive secure software delivery across the SDLC. You will develop a deep understanding of business apps and platforms, review security findings, and guide risk-based remediation with engineering teams.

The role requires extensive knowledge of application security, secure coding practices, and modern cloud/native architectures, with strong collaboration across risk, product, and development functions.

Qualifications

• 10+ years in Information Security or Technology Risk.
• 5+ years in Application Security or Vulnerability Management.
• Experience with security testing and code analysis.
• Knowledge of NIST/ISO/PCI DSS frameworks.
• Ability to communicate risk to technical and non-technical audiences.

Responsibilities

• Serve as technical reviewer for application security findings from Checkmarx One and other tools.
• Analyze source code, architecture, APIs, and data flows for vulnerability validity.
• Validate and disposition findings with evidence-based analysis.
• Collaborate with developers, architects, and risk partners to drive secure development practices.
• Lead risk-informed decisions and strengthen secure coding across SDLC.

Skills

Application Security

Secure SDLC

Vulnerability Management

Threat Modeling

Communication

Risk Assessment

Stakeholder Management

Security Architecture

DevSecOps

OWASP Top 10

Education

Bachelor's or Master's in CS/IT/CYBERSEC

CISSP/CWSP or equivalent

Tools

Checkmarx One

Job description

Bank of America is seeking a Product Manager - Tech Delivery to partner with BISO and CIOs to drive secure software delivery across the SDLC. You will develop a deep understanding of business apps and platforms, review security findings, and guide risk-based remediation with engineering teams.

The role requires extensive knowledge of application security, secure coding practices, and modern cloud/native architectures, with strong collaboration across risk, product, and development functions.