The Product Security Lead serves as a hands-on security leader who embeds security into application and data lifecycles across the organization. This role drives secure development, testing, and DevSecOps practices; performs threat modeling and design risk assessments to identify and mitigate risks early; and delivers application security services including SAST, DAST, and software composition analysis. The role also supports data security, cloud security across IaaS, PaaS, and SaaS, and secure AI adoption initiatives to ensure risk-informed, business-aligned outcomes.
Key Responsibilities:- Secure Development & DevSecOps
- Embed security into application and data lifecycles through secure development, testing, and DevSecOps practices
- Integrate automated security testing and policy guardrails into CI/CD pipelines
- Partner with engineering teams to advance secure coding standards and developer enablement
- Application Security Services
- Deliver application security services, including SAST, DAST, and software composition analysis
- Triage, validate, and prioritize findings to reduce false positives and developer friction
- Manage open-source and third-party component risk through dependency and license analysis
- Data, Cloud & Secure AI Adoption
- Support data security initiatives across classification, protection, and lifecycle controls
- Advise on secure configuration and controls across cloud environments (IaaS, PaaS, and SaaS)
- Guide secure AI adoption, addressing model, data, and application-layer risks
- Leadership & Collaboration
- Lead and develop a high-performing product security practice
- Partner closely with engineering, platform, and data teams to align security with delivery
- Champion a culture of security ownership and shared accountability across product teams
Required Qualifications:- Extensive experience in product, application, or software security engineering within financial services.
- Deep expertise in secure development, DevSecOps, threat modeling, and design risk assessment
- Hands-on experience with application security tooling, including SAST, DAST, and software composition analysis
- Strong knowledge and hands-on experience of data security, cloud security (IaaS/PaaS/SaaS), and emerging secure AI practices
- Exceptional stakeholder engagement, communication, and influencing skills
Hybrid position in NYC.
The expected base salary ranges from $150k-$215k. Salary offers are based on a wide range of factors including relevant skills, training, experience, education, and, where applicable, certifications and licenses obtained. Market and organizational factors are also considered. In addition to salary and a generous employee benefits package, successful candidates are eligible to receive a discretionary bonus.
#LI-Hybrid
Other requirementsMizuho has in place a hybrid working program, with varying opportunities for remote work depending on the nature of the role, needs of your department, as well as local laws and regulatory obligations. Roles in some of our departments have greater in-office requirements that will be communicated to you as part of the recruitment process
