Principal Product Security Engineer

Make banking a Fifth Third better®
We connect great people to great opportunities. Are you ready to take the next step? Discover a career in banking at Fifth Third Bank.

• Technical depth and sound engineering judgment
• Secure-by-design and root-cause thinking
• Risk-based decision-making
• Clear communication and documentation
• Cross-functional influence and collaboration
• Independent execution, accountability, and continuous learning

As a Principal Product Security Engineer, you will operate with significant technical autonomy to advance Product Security across customer-facing products. Initial priorities include driving security readiness items through independently validated closure and helping build Prod Sec
360, while establishing scalable engineering practices that strengthen the broader Product Security program.

• Define practical security requirements and reusable, secure-by-default patterns for in-scope customer-facing software, APIs, SDKs, integrations, cloud deployments, and distributed services.
• Translate product risk into engineering controls, acceptance criteria, validation approaches, and durable remediation guidance.
• Own Product Security SOC2 readiness items from assessment through verified closure, driving stakeholder coordination, remediation commitments, dependencies, evidence collection, and follow-through.
• Independently validate reported remediation through risk-appropriate technical testing, such as code, configuration, application, API, cloud, infrastructure, or security-control testing, confirming the underlying security condition is resolved before closure.
• Advance software supply chain practices, including dependency governance, software bills of materials, artifact integrity, provenance, and code signing.
• Define risk-based validation strategies using product exposure, architecture, customer impact, and material change.
• Evaluate findings in product context and provide clear remediation priorities, secure patterns, and evidence-based release guidance.
• Lead the design and build of Prod Sec
  360, the authoritative product-level view of security posture for in-scope customer-facing products, including its data model, scoring approach, architecture, ingestion patterns, user experience, and technical roadmap.
• Build Prod Sec
  360 capabilities that integrate findings, threat models, penetration-test status, scanning and SBOM completeness, remediation aging, secure-pattern adoption, post-release outcomes, assessment evidence, and customer‑assurance readiness into actionable product risk views.
• Use approved AI‑assisted development tools to accelerate design, implementation, and testing, and build agentic workflows and automations that reduce manual effort across Prod Sec
  360 and Product Security processes.
• Provide senior technical judgment for high‑risk or emerging scenarios and mature Product Security standards and roadmap priorities.

• Work with engineers and architects to assess complex designs and implementations for trust boundaries, excessive privilege, insecure data exposure, misuse scenarios, resilience, and customer impact.
• Set coverage expectations and assess outcomes from architecture reviews, threat modeling, penetration testing, and risk‑based application and API testing.
• Investigate complex issues using source code, designs, test results, cloud configuration, logs, and other evidence.
• Partner with source‑system owners, data and platform engineering, risk, architecture, and security teams to establish reliable integrations, data quality, traceability, access controls, and sustainable operating support for Prod Sec
  360.
• Develop practical security guardrails for coding assistants, autonomous or semi‑autonomous agents, generative AI, and…