Lead Information Security Consultant – API Security, Governance

• Lead the development, maintenance, and evolution of enterprise API security standards, controls, and governance practices
• Assess and improve the bank's overall API security posture through security reviews, risk assessments, and control evaluations
• Provide guidance on secure API architecture, authentication, authorization, encryption, threat protection, monitoring, and lifecycle management
• Partner with Information Security, Technology Risk, Enterprise Architecture, and engineering teams to identify and mitigate API security risks
• Conduct architecture reviews, threat modeling exercises, and security assessments for API-enabled applications and platforms
• Define and promote API security best practices, reusable security patterns, and governance frameworks across the enterprise
• Influence technology teams to adopt secure-by-design API development and implementation practices
• Support regulatory, compliance, audit, and risk management activities related to API and Application Security
• Serve as a trusted advisor and subject matter expert for API Security and Application Security initiatives
• Stay current on emerging API threats, vulnerabilities, technologies, and industry best practices
• Collaborate with platform teams supporting Apigee, GraphQL, AI APIs, AWS API Gateway, and other API technologies
• Drive alignment between business objectives, security requirements, and enterprise technology standards

• 10+ years of experience in Information Security, Application Security, API Security, Security Architecture, or a related field
• Deep expertise in API Security and Application Security principles, frameworks, and best practices
• Experience developing, implementing, and enforcing security standards, governance models, controls, and policies
• Strong understanding of secure API design, architecture, authentication, authorization, and risk management
• Experience performing threat modeling, security reviews, architecture assessments, and risk evaluations
• Proven ability to assess and improve an organization's API security posture
• Experience partnering with security, risk, architecture, business, and engineering stakeholders across large enterprise environments
• Strong understanding of security frameworks, regulatory requirements, and compliance considerations
• Prior hands‑on technical experience with application development, APIs, or API technologies
• Ability to influence decision‑making and drive security initiatives without direct authority
• Experience with API gateway technologies such as Apigee, AWS API Gateway, GraphQL gateways, Kong, Mule Soft, or similar platforms
• Knowledge of the OWASP API Security Top 10 and common API attack vectors
• Experience with OAuth 2.0, OpenID Connect (OIDC), JWT, mTLS, API threat protection, and modern authentication frameworks
• Experience supporting API governance programs within financial services or other highly regulated industries
• Exposure to API penetration testing, security testing methodologies, and vulnerability management practices
• Knowledge of cloud‑native application architectures, microservices, and distributed systems
• Experience developing enterprise security reference architectures and reusable security patterns
• Security certifications such as CISSP, CSSLP, GWAPT, or equivalent
• Experience securing modern API ecosystems, including AI APIs and emerging API technologies
• Applicants must be able to comply with U.S. Bank policies and procedures including the Code of Ethics and Business Conduct and related workplace conduct and safety policies
• Must satisfy applicable employment eligibility verification requirements

Demonstrates deep expertise in API Security and Application Security principles, frameworks, and best practices, with a strong focus on secure API design, architecture, and risk management. Proven ability to assess and enhance an organization's API security posture while collaborating with cross‑functional teams in highly regulated environments.

• API Security
• Application Security
• Security Architecture
• Threat Modeling
• Regulatory Compliance

• API Security Principles
• Secure API Design
• Risk Management
• Security Standards Development
• Threat Protection
• Security Assessments
• Vulnerability Management
• OAuth 2.0
• OpenID Connect
• API Penetration Testing

• Influencing Decision-Making
• Collaboration
• Advisory Skills

• CISSP
• CSSLP
• GWAPT

• Financial Services
• Compliance
• Governance Frameworks
• Security Frameworks
• API Ecosystems

• Apigee
• AWS API Gateway
• GraphQL
• Kong
• Mule Soft