Product Security Governance Principal

Virtual

Cincinnati, OH

Full time

R73100

Make banking a Fifth Third better® We connect great people to great opportunities. Are you ready to take the next step? Discover a career in banking at Fifth Third Bank.

• Governance leadership and sound risk judgment
• Evidence-based assurance and control evaluation
• Customer trust, readiness, and compliance coordination
• Clear executive, audit, business, and technical communication
• Cross-functional influence and constructive challenge
• Independent execution, accountability, and follow-through
• Scalable process design and continuous improvement

• Lead and mature Product Security governance for internally developed customer-facing software, APIs, SDKs, integrations, and related services.
• Define product scope, engagement criteria, review expectations, decision authorities, escalation paths, and evidence standards.
• Develop and maintain standards, procedures, playbooks, templates, decision records, risk records, and supporting guidance.
• Facilitate risk-based decisions involving security requirements, control applicability, exceptions, compensating controls, and accountability.
• Align Product Security practices with established enterprise architecture, application security, vulnerability management, risk, compliance, audit, and engineering processes.

• Lead a scalable customer assurance model for applicable products and services.
• Coordinate accurate, reviewable security summaries, whitepapers, assessment responses, and supporting evidence.
• Evaluate customer-facing security statements for appropriate scope, context, qualifications, and evidence.
• Partner with Product, Engineering, Risk, Compliance, Legal, Audit, and customer-facing teams to support customer, deal, regulatory, and audit needs.
• Establish traceability between assurance statements, controls, evidence sources, and accountable owners while increasing consistency and response efficiency.

• Lead Product Security coordination for applicable SOC 2 and related readiness activities within established enterprise compliance and audit processes.
• Support system scoping, business-requirement validation, readiness evaluations, gap assessments, evidence coordination, and assessment-provider engagement.
• Partner with control owners to evaluate control design, evidence requirements, operating effectiveness, and improvement opportunities.
• Maintain readiness plans, evidence inventories, dependencies, decisions, and accountable action tracking.
• Translate assessment observations into sustainable improvements while preserving appropriate separation from independent audit or attestation responsibilities.

• Define consistent expectations for product readiness assessments and product-level security evidence.
• Evaluate evidence from established activities such as threat modeling, penetration testing, security scanning, software supply chain practices, secure development, incident management, and remediation.
• Assess evidence for completeness, relevance, recency, traceability, and applicability, including the context and limitations of technical tools.
• Develop consolidated views of product security risk, control adoption, coverage, and assurance readiness.
• Establish meaningful indicators and reporting that demonstrate Product Security adoption, maturity, decisions, and accountable actions.

• Lead governance forums, readiness reviews, working sessions, and decision meetings.
• Identify recurring themes and recommend scalable improvements to controls, evidence, processes, and stakeholder guidance.
• Provide concise updates and practical recommendations to technical teams, business stakeholders, and senior leaders.
• Contribute to Product Security strategy, planning, prioritization, and roadmap development.
• Promote shared accountability for secure and trusted customer-facing products.

• Seven or more years of progressively responsible experience in Product Security, security governance, cybersecurity assurance, IT risk, security compliance, technology audit, security architecture, or a related discipline.
• Demonstrated success leading security governance, assurance, readiness, control evaluation, gap analysis, or evidence-review practices in a complex organization.
• Proven ability to independently evaluate technical and nontechnical evidence, identify material concerns, exercise sound judgment, and recommend…