Principal Product Security Engineer

Fifth Third Bank · Virtual · $96,500–$207,500 (stated in the posting)

Apply on the company website

Make banking a Fifth Third better®
We connect great people to great opportunities. Are you ready to take the next step? Discover a career in banking at Fifth Third Bank.

Core Competencies

• Technical depth and sound engineering judgment

• Secure-by-design and root-cause thinking

• Risk-based decision-making

• Clear communication and documentation

• Cross-functional influence and collaboration

• Independent execution, accountability, and continuous learning

Role Focus
As a Principal Product Security Engineer, you will operate with significant technical autonomy to advance Product Security across customer-facing products. Initial priorities include driving security readiness items through independently validated closure and helping build ProdSec360, while establishing scalable engineering practices that strengthen the broader Product Security program.

Key Responsibilities

Own

• Define practical security requirements and reusable, secure-by-default patterns for in-scope customer-facing software, APIs, SDKs, integrations, cloud deployments, and distributed services.
• Translate product risk into engineering controls, acceptance criteria, validation approaches, and durable remediation guidance.
• Own Product Security SOC2 readiness items from assessment through verified closure, driving stakeholder coordination, remediation commitments, dependencies, evidence collection, and follow-through.
• Independently validate reported remediation through risk-appropriate technical testing, such as code, configuration, application, API, cloud, infrastructure, or security-control testing, confirming the underlying security condition is resolved before closure.
• Advance software supply chain practices, including dependency governance, software bills of materials, artifact integrity, provenance, and code signing.
• Define risk-based validation strategies using product exposure, architecture, customer impact, and material change.
• Evaluate findings in product context and provide clear remediation priorities, secure patterns, and evidence-based release guidance.
• Lead the design and build of ProdSec360, the authoritative product-level view of security posture for in-scope customer-facing products, including its data model, scoring approach, architecture, ingestion patterns, user experience, and technical roadmap.
• Build ProdSec360 capabilities that integrate findings, threat models, penetration-test status, scanning and SBOM completeness, remediation aging, secure-pattern adoption, post-release outcomes, assessment evidence, and customer-assurance readiness into actionable product risk views.

• Use approved AI-assisted development tools to accelerate design, implementation, and testing, and build agentic workflows and automations that reduce manual effort across ProdSec360 and Product Security processes.

• Provide senior technical judgment for high-risk or emerging scenarios and mature Product Security standards and roadmap priorities.

Partner

• Work with engineers and architects to assess complex designs and implementations for trust boundaries, excessive privilege, insecure data exposure, misuse scenarios, resilience, and customer impact.
• Set coverage expectations and assess outcomes from architecture reviews, threat modeling, penetration testing, and risk-based application and API testing.
• Investigate complex issues using source code, designs, test results, cloud configuration, logs, and other evidence.
• Partner with source-system owners, data and platform engineering, risk, architecture, and security teams to establish reliable integrations, data quality, traceability, access controls, and sustainable operating support for ProdSec360.
• Develop practical security guardrails for coding assistants, autonomous or semi-autonomous agents, generative AI, and related development technologies with Engineering, Architecture, and AI governance partners.

Influence

• Influence engineering, product, and architecture decisions so security requirements are considered early and proportionately.
• Drive adoption of reusable secure patterns and scalable platform improvements that reduce repeated implementation effort.
• Drive adoption of ProdSec360 as the shared decision-support capability for product risk prioritization, readiness assessments, executive reporting, audits, customer assurance, and incident response.
• Translate emerging threats, including risks involving agent permissions, tool access, sensitive context, generated code, dependencies, data handling, and automated changes, into actionable guidance.
• Create standards, playbooks, technical guidance, and engineering enablement materials that help teams apply the security bar independently.
• Turn recurring issues and lessons learned into reusable controls and platform improvements.
• Mentor security and engineering partners and raise technical capability across the Product Security program.

What Success Looks Like

• Teams receive clear security requirements early enough to influence design.
• Reusable patterns make secure implementation easier and more consistent.
• Validation decisions reflect product context, customer impact, and evidence.
• Readiness items progress from identification through independently validated closure, with the Principal Engineer proactively driving the conversations, stakeholders, dependencies, evidence, and technical validation needed to reach an outcome.
• ProdSec360 provides a trusted, current, and explainable view of product risk, coverage gaps, trends, and assurance readiness that stakeholders can use without reconstructing evidence manually.
• Engineering teams view Product Security as a credible, collaborative partner.

Required Qualifications

• Eight or more years of relevant experience across Product Security, Application Security, Security Engineering, Software Engineering, Cloud Security, Platform Engineering, or related disciplines.
• Hands-on experience building, securing, testing, or operating production software or cloud platforms.
• Demonstrated ability to investigate security weaknesses using code, technical designs, test results, configurations, logs, and related evidence.
• Experience translating risk into practical engineering requirements, secure patterns, prioritization, and remediation guidance.
• Demonstrated ability to independently own complex security work from problem definition through cross-functional coordination, technical validation, and closure.
• Working knowledge of source control, CI/CD, automated testing, cloud deployment, containers, and infrastructure-as-code.
• Strong knowledge of common application and API risks, including the OWASP Top 10 and OWASP API Security Top 10.
• Proficiency in at least one programming or scripting language and the ability to review application code.

• Demonstrated hands-on experience using Claude Code, GitHub Copilot, or comparable AI-assisted development tools to build software, agentic workflows, and automations, including reviewing and testing generated code.

• Strong communication, collaboration, independent judgment, and ability to influence without direct authority.
• Bachelor’s degree in a related field or an equivalent combination of education and experience.

Preferred Qualifications

• Experience building or maturing a Product Security or Application Security program.
• Experience securing financial services, payment products, SaaS platforms, or other high-value transactional systems.
• Deep expertise in several of the following, with strong working knowledge across the remainder: application security, API security, cloud and container security, software supply chain security, security testing, or DevSecOps.
• Experience with threat modeling, security assessments, reusable patterns, platform guardrails, Kubernetes, serverless, or AI-enabled development.
• Knowledge of NIST, OWASP SAMM, the NIST Secure Software Development Framework, or comparable guidance.
• One or more relevant certifications, such as CISSP, CSSLP, CCSP, OSCP, OSWE, GIAC, or a cloud-security credential.
  

Position not eligible for immigration sponsorship.

At Fifth Third, we understand the importance of recognizing our employees for the role they play in improving the lives of our customers, communities and each other. Our Total Rewards include comprehensive benefits and differentiated compensation offerings to give each employee the opportunity to be their best every day.

The base salary for this position is reflective of the range of salary levels for all roles within this pay grade across the U.S. Individual salaries within this range will vary based on factors such as role, relevant skillset, relevant experience, education and geographic location. In addition to the base salary, this role is eligible to participate in an incentive compensation plan, with any such payment based upon company, line of business and/or individual performance.

Our extensive benefits programs are designed to support the individual needs of our employees and their families, encompassing physical, financial, emotional and social well-being. You can learn more about those programs on our 53.com Careers page at: https://www.53.com/content/fifth-third/en/careers/benefits.html or by consulting with your talent acquisition partner. 

Attention search firms and staffing agencies: do not submit unsolicited resumes for this posting.  Fifth Third does not accept resumes from any agency that does not have an active agreement with Fifth Third.  Any unsolicited resumes – no matter how they are submitted – will be considered the property of Fifth Third and Fifth Third will not be responsible for any associated fee.

Fifth Third Bank, National Association is proud to have an engaged and inclusive culture and to promote and ensure equal employment opportunity in all employment decisions regardless of race, color, gender, national origin, religion, age, disability, sexual orientation, gender identity, military status, veteran status or any other legally protected status.

More jobs at Fifth Third Bank