Vice President - Product and Platform Security

About the role

The Vice President of Product and Platform Security leads the security architecture and engineering for all Federal Reserve Financial Services products and platforms. This senior leader embeds security throughout the product lifecycle, partners with product and engineering teams, and advises senior leadership on risk‑based decisions.

Key responsibilities

• Develop and maintain comprehensive security architecture for all FRFS products and platforms, ensuring compliance with Federal Reserve System security standards and effective risk mitigation.
• Oversee secure reference architectures, design patterns, and technical standards for FRFS products; ensure security architecture reviews for all new products, major enhancements, and technology changes.
• Establish and mature secure software development lifecycle (SSDLC) practices, integrating threat modeling and secure coding into Agile/DevSecOps workflows.
• Guide evaluation and adoption of security technologies, tools, and controls; drive DevSecOps practices, security automation, and shift‑left security principles across product teams.
• Identify, assess, and communicate security risks to stakeholders in collaboration with the FRFS Cyber Strategy, Risk, Resiliency Department.
• Lead, mentor, and develop the Product and Platform Security team, fostering a culture of excellence, collaboration, and continuous learning.
• Build and maintain strong partnerships with FRFS product management, software engineering, architecture, and operations teams, serving as a trusted security advisor.
• Provide strategic security guidance for FRFS product roadmaps, architecture decisions, and technology investments; partner with senior leadership on strategic planning.
• Represent FRFS product and platform security interests in Federal Reserve System forums, committees, and working groups.

Required profile

• Bachelor’s degree in Computer Science, Information Security, Engineering or related field; Master’s degree and professional security certifications (CISSP, CSSLP, CEH, GIAC) preferred.
• 10+ years progressive experience in information security, with at least 5 years in application/product security or secure development.
• 5+ years leading security teams in large, complex organizations, preferably in financial services, government, or highly regulated industries.
• Deep technical understanding of application security principles, secure design patterns, NIST frameworks, SSDLC, DevSecOps, threat modeling, and security testing approaches.
• Strong knowledge of modern application architectures (microservices, APIs, containers, cloud‑native) and cloud security (AWS, Azure, GCP).
• Ability to translate business objectives into security strategies, influence change without direct authority, and navigate complex organizational dynamics.
• Exceptional communication and presentation skills to explain complex technical security concepts to diverse audiences.
• Willingness to travel occasionally (10‑15%) and ability to obtain and maintain a national security clearance.

Required skills

• Application security principles
• Secure design patterns
• NIST frameworks and standards
• Secure Software Development Lifecycle (SSDLC)
• DevSecOps methodologies
• Threat modeling
• Security testing: SAST, DAST, IAST, SCA, penetration testing
• Microservices, APIs, containers, cloud‑native architectures
• Cloud security platforms: AWS, Azure, GCP
• Cryptography and authentication protocols

What we offer

• Comprehensive benefits package including medical, dental, vision, 401k, retirement plan, paid time off, transit benefit, onsite gym and subsidized cafeteria.
• Learning environment with opportunities to gain new skills and grow your career.