Product Security Lead

Madison-Davis, LLC; New York (NY); Hybrid; USD 140,000 - 210,000; Full time

Job summary

Madison-Davis, LLC is seeking a hands-on Product Security Lead to embed security across application and data lifecycles within our global financial services environment. You will collaborate with software engineering, platform, and data teams to strengthen secure development, automate controls, and identify risk earlier in delivery.

You will drive DevSecOps, cloud security, and AI-security initiatives, balancing hands-on security work with leadership to improve security practices and ownership

Qualifications

• Extensive experience in product, application, or software-security engineering.
• Financial-services experience.
• Strong Secure SDLC and DevSecOps expertise.
• Hands-on threat-modeling and design-risk-assessment experience.
• SAST, DAST, and software composition analysis experience.
• Strong data-security knowledge.
• Hands-on cloud-security experience across IaaS, PaaS, and SaaS.
• Practical knowledge of emerging AI-security risks and controls.
• Strong communication, stakeholder-management, and influencing skills.
• Ability to meet the required New York City hybrid schedule.

Responsibilities

• Embed security into application and data-development lifecycles.
• Advance secure-development and DevSecOps practices.
• Integrate automated security testing and policy controls into CI/CD pipelines.
• Conduct threat modeling and application-design risk assessments.
• Deliver and improve SAST, DAST, and software composition analysis capabilities.
• Validate and prioritize security findings while reducing false positives.
• Address open-source and third-party dependency risk.
• Support security across cloud and data environments.
• Guide security practices for emerging AI-enabled applications.
• Partner with engineering, platform, and data teams to strengthen security ownership.

Skills

Product security engineering

Secure SDLC

DevSecOps

Threat modeling

SAST/DAST

Cloud security

Data security

Communication / stakeholder mgmt

Tools

CI/CD tooling

SAST

DAST

Software composition analysis

Threat modeling tools

Cloud security tooling

Job description

A global financial institution is seeking a hands-on Product Security Lead to embed security throughout application and data lifecycles. The role works closely with software engineering, platform, and data teams to strengthen secure development, automate security controls, assess application designs, and identify risk earlier in the delivery process. This person will operate across application security, DevSecOps, cloud security, data security, and emerging AI-security initiatives. The position requires someone who can remain technically involved while helping engineering teams adopt stronger security practices.

RESPONSIBILITIES

• Embed security into application and data-development lifecycles.
• Advance secure-development and DevSecOps practices.
• Integrate automated security testing and policy controls into CI/CD pipelines.
• Conduct threat modeling and application-design risk assessments.
• Deliver and improve SAST, DAST, and software composition analysis capabilities.
• Validate and prioritize security findings while reducing false positives.
• Address open-source and third-party dependency risk.
• Support security across cloud and data environments.
• Guide security practices for emerging AI-enabled applications.
• Partner with engineering, platform, and data teams to strengthen security ownership.

Role Requirements

• Extensive experience in product, application, or software-security engineering.
• Financial-services experience.
• Strong Secure SDLC and DevSecOps expertise.
• Hands-on threat-modeling and design-risk-assessment experience.
• SAST, DAST, and software composition analysis experience.
• Strong data-security knowledge.
• Hands-on cloud-security experience across IaaS, PaaS, and SaaS.
• Practical knowledge of emerging AI-security risks and controls.
• Strong communication, stakeholder-management, and influencing skills.
• Ability to meet the required New York City hybrid schedule.

How We Work

Security partners directly with engineering, platform, and data teams. Security controls are expected to be integrated into the development lifecycle. The role balances hands-on technical involvement with security-practice leadership. The position follows a hybrid New York City schedule.