Product Security Lead: Secure by Design & Risk Expert

Flagstar Bank; Troy (MI); On-site; USD 159,075 - 242,112; Full time

Benefits offered by this job

Medical benefits

Dental benefits

Vision benefits

Leave program

Job summary

Flagstar Bank in New York, NY seeks a Product Security Principal to be the embedded security subject matter expert for designated product lines, partnering with Tech Leads and BURMs to foster a security-first culture from design through deployment.

You will own application security requirements, lead threat modeling, security testing, and secure coding practices, translating regulatory needs into actionable controls within the product's technology supply chain.

Qualifications

• Education level: High School or equivalent; Undergraduate degree preferred.
• 8+ years in information security, cybersecurity, or technology risk management.
• Experience translating policy into control designs for engineers/architects.
• Proven ability to communicate with technical and non-technical stakeholders.

Responsibilities

• Embed threat modeling, security architecture reviews, and secure coding practices across product teams.
• Own application security requirements, authentication/authorization design, and data handling standards.
• Lead security testing, vulnerability assessments, and penetration testing coordination; track remediation.
• Prepare security artifacts for Technology Review Board and release readiness.

Skills

Threat modeling

SSDLC

Cloud security

DevSecOps

Security testing

Regulatory compliance

3LoD awareness

Education

Undergraduate degree

Tools

Azure/AWS

APIs/microservices

IAM

Secrets management

CI/CD security

Job description

Flagstar Bank in New York, NY seeks a Product Security Principal to be the embedded security subject matter expert for designated product lines, partnering with Tech Leads and BURMs to foster a security-first culture from design through deployment.

You will own application security requirements, lead threat modeling, security testing, and secure coding practices, translating regulatory needs into actionable controls within the product's technology supply chain.