Product Security Lead

Madison-Davis, LLC; New York (NY); Hybrid; USD 180,000 - 240,000; Full time

Job summary

Madison-Davis, LLC is seeking a hands-on Product Security Lead to embed security across application and data lifecycles. You will work with software engineering, platform, and data teams to strengthen secure development, automate security controls, and identify risk earlier in delivery processes.

The role spans application security, cloud security, data security, and AI-security initiatives. You will remain technically involved while helping engineering teams adopt stronger security practices,

Qualifications

• Hands-on threat-modeling and design-risk-assessment experience.
• Strong Secure SDLC and DevSecOps expertise.
• Experience delivering SAST/DAST and software composition analysis capabilities.
• Solid data-security knowledge and cloud-security experience across IaaS, PaaS, SaaS.

Responsibilities

• Embed security into application and data lifecycles.
• Advance secure-development and DevSecOps practices.
• Integrate automated security testing into CI/CD pipelines.
• Conduct threat modeling and application-design risk assessments.
• Deliver and improve SAST, DAST, and software composition analysis capabilities.
• Validate and prioritize security findings while reducing false positives.
• Address open-source and third-party dependency risk.
• Support security across cloud and data environments.
• Guide security practices for emerging AI-enabled applications.
• Partner with engineering, platform, and data teams to strengthen security ownership.

Skills

Application security

DevSecOps

Threat modeling

SAST/DAST

Data security

Cloud security

AI security

Communication

Hybrid NYC schedule

Job description

A global financial institution is seeking a hands-on Product Security Lead to embed security throughout application and data lifecycles. The role works closely with software engineering, platform, and data teams to strengthen secure development, automate security controls, assess application designs, and identify risk earlier in the delivery process.

This person will operate across application security, DevSecOps, cloud security, data security, and emerging AI-security initiatives. The position requires someone who can remain technically involved while helping engineering teams adopt stronger security practices.

Responsibilities

• Embed security into application and data-development lifecycles.
• Advance secure-development and DevSecOps practices.
• Integrate automated security testing and policy controls into CI/CD pipelines.
• Conduct threat modeling and application-design risk assessments.
• Deliver and improve SAST, DAST, and software composition analysis capabilities.
• Validate and prioritize security findings while reducing false positives.
• Address open-source and third-party dependency risk.
• Support security across cloud and data environments.
• Guide security practices for emerging AI-enabled applications.
• Partner with engineering, platform, and data teams to strengthen security ownership.

Role Requirements

• Extensive experience in product, application, or software-security engineering.
• Strong Secure SDLC and DevSecOps expertise.
• Hands-on threat-modeling and design-risk-assessment experience.
• SAST, DAST, and software composition analysis experience.
• Strong data-security knowledge.
• Hands-on cloud-security experience across IaaS, PaaS, and SaaS.
• Practical knowledge of emerging AI-security risks and controls.
• Strong communication, stakeholder-management, and influencing skills.
• Ability to meet the required New York City hybrid schedule.

How We Work

• Security partners directly with engineering, platform, and data teams.
• Security controls are expected to be integrated into the development lifecycle.
• The role balances hands-on technical involvement with security-practice leadership.
• The position follows a hybrid New York City schedule.