Product Security Lead

Mizuho; New York (NY); Hybrid; USD 150,000 - 215,000; Full time

Job summary

Mizuho is seeking a Product Security Lead to act as a hands-on security leader, embedding security into application and data lifecycles across the organization. You will drive secure development, testing, and DevSecOps, perform threat modeling and design risk assessments, and deliver SAST/DAST and software composition analysis services.

Hybrid position in NYC with a base salary range of $150k–$215k. You will also guide secure AI adoption and ensure risk-informed, business-aligned outcomes across

Qualifications

• Experience in product, application, or software security within financial services.
• Hands-on security leadership embedding security into lifecycles.
• Proficient in secure development, DevSecOps, threat modeling and risk assessment.

Responsibilities

• Secure Development & DevSecOps practices across lifecycles.
• Integrate automated security testing into CI/CD pipelines.
• Partner with engineering to advance secure coding standards.

Skills

Secure development

DevSecOps

Threat modeling

Design risk assessment

Application security tooling

SAST

DAST

Software composition analysis

Stakeholder engagement

Cloud security

Tools

SAST

DAST

Software composition analysis

Job description

Join Mizuho as a Product Security Lead!

The Product Security Lead serves as a hands-on security leader who embeds security into application and data lifecycles across the organization. This role drives secure development, testing, and DevSecOps practices; performs threat modeling and design risk assessments to identify and mitigate risks early; and delivers application security services including SAST, DAST, and software composition analysis. The role also supports data security, cloud security across IaaS, PaaS, and SaaS, and secure AI adoption initiatives to ensure risk-informed, business-aligned outcomes.

Join Mizuho as a Product Security Lead!

The Product Security Lead serves as a hands-on security leader who embeds security into application and data lifecycles across the organization. This role drives secure development, testing, and DevSecOps practices; performs threat modeling and design risk assessments to identify and mitigate risks early; and delivers application security services including SAST, DAST, and software composition analysis. The role also supports data security, cloud security across IaaS, PaaS, and SaaS, and secure AI adoption initiatives to ensure risk-informed, business-aligned outcomes.

Key Responsibilities

• Secure Development & DevSecOps
  • Embed security into application and data lifecycles through secure development, testing, and DevSecOps practices
  • Integrate automated security testing and policy guardrails into CI/CD pipelines
  • Partner with engineering teams to advance secure coding standards and developer enablement
• Application Security Services
  • Deliver application security services, including SAST, DAST, and software composition analysis
  • Triage, validate, and prioritize findings to reduce false positives and developer friction
  • Manage open-source and third-party component risk through dependency and license analysis
• Data, Cloud & Secure AI Adoption
  • Support data security initiatives across classification, protection, and lifecycle controls
  • Advise on secure configuration and controls across cloud environments (IaaS, PaaS, and SaaS)
  • Guide secure AI adoption, addressing model, data, and application-layer risks
• Leadership & Collaboration
  • Lead and develop a high-performing product security practice
  • Partner closely with engineering, platform, and data teams to align security with delivery
  • Champion a culture of security ownership and shared accountability across product teams

Required Qualifications

• Extensive experience in product, application, or software security engineering within financial services.
• Deep expertise in secure development, DevSecOps, threat modeling, and design risk assessment
• Hands-on experience with application security tooling, including SAST, DAST, and software composition analysis
• Strong knowledge and hands-on experience of data security, cloud security (IaaS/PaaS/SaaS), and emerging secure AI practices
• Exceptional stakeholder engagement, communication, and influencing skills

Hybrid position in NYC.

The expected base salary ranges from $150k-$215k. Salary offers are based on a wide range of factors including relevant skills, training, experience, education, and, where applicable, certifications and licenses obtained. Market and organizational factors are also considered. In addition to salary and a generous employee benefits package, successful candidates are eligible to receive a discretionary bonus.

Other Requirements

Mizuho has in place a hybrid working program, with varying opportunities for remote work depending on the nature of the role, needs of your department, as well as local laws and regulatory obligations. Roles in some of our departments have greater in-office requirements that will be communicated to you as part of the recruitment process.

Company Overview

Mizuho Financial Group, Inc. is the 15th largest bank in the world as measured by total assets of ~$2 trillion. Mizuho's 60,000 employees worldwide offer comprehensive financial services to clients in 35 countries and 800 offices throughout the Americas, EMEA and Asia. Mizuho Americas is a leading provider of corporate and investment banking services to clients in the US, Canada, and Latin America. Through its acquisition of Greenhill , Mizuho provides M&A, restructuring and private capital advisory capabilities across Americas, Europe and Asia. Mizuho Americas employs approximately 3,500 professionals, and its capabilities span corporate and investment banking, capital markets, equity and fixed income sales & trading, derivatives, FX, custody and research. Visit www.mizuhoamericas.com.

Mizuho Americas offers a competitive total rewards package.

We are an EEO/AA Employer - M/F/Disability/Veteran.

We participate in the E-Verify program.

We maintain a drug-free workplace and reserve the right to require pre- and post-hire drug testing as permitted by applicable law.