Lead Information Security Consultant – API Security, Governance

U.S. Bank

. Lead the development, maintenance, and evolution of enterprise API security standards, controls, and governance practices .

Posted 10/5/2026full-timeUnited StatesSenior💰 $126,820 - $149,200 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates deep expertise in API Security and Application Security principles, frameworks, and best practices, with a strong focus on secure API design, architecture, and risk management. Proven ability to assess and enhance an organization's API security posture while collaborating with cross-functional teams in a highly regulated environment.

Highest-signal resume keywords

API SecurityApplication SecuritySecurity ArchitectureThreat ModelingSecurity Governance

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

API Security PrinciplesSecure API DesignRisk ManagementSecurity Standards DevelopmentArchitecture AssessmentsThreat ProtectionVulnerability ManagementOAuth 2.0OpenID ConnectAPI Penetration Testing

Soft Skills

Influencing Decision-MakingCollaborationAdvisory Skills

Tools & Technologies

ApigeeAWS API GatewayGraphQLKongMuleSoft

Certifications & Qualifications

CISSPCSSLPGWAPT

Industry Keywords

Financial ServicesRegulatory ComplianceSecurity FrameworksAPI GovernanceEmerging API Technologies

Tech Stack

Tools & technologies

AWSCloudDistributed SystemsGraphQLMicroservices

About the role

Key responsibilities & impact

Lead the development, maintenance, and evolution of enterprise API security standards, controls, and governance practices
Assess and improve the bank's overall API security posture through security reviews, risk assessments, and control evaluations
Provide guidance on secure API architecture, authentication, authorization, encryption, threat protection, monitoring, and lifecycle management
Partner with Information Security, Technology Risk, Enterprise Architecture, and engineering teams to identify and mitigate API security risks
Conduct architecture reviews, threat modeling exercises, and security assessments for API-enabled applications and platforms
Define and promote API security best practices, reusable security patterns, and governance frameworks across the enterprise
Influence technology teams to adopt secure-by-design API development and implementation practices
Support regulatory, compliance, audit, and risk management activities related to API and Application Security
Serve as a trusted advisor and subject matter expert for API Security and Application Security initiatives
Stay current on emerging API threats, vulnerabilities, technologies, and industry best practices
Collaborate with platform teams supporting Apigee, GraphQL, AI APIs, AWS API Gateway, and other API technologies
Drive alignment between business objectives, security requirements, and enterprise technology standards

Requirements

What you’ll need

10+ years of experience in Information Security, Application Security, API Security, Security Architecture, or a related field
Deep expertise in API Security and Application Security principles, frameworks, and best practices
Experience developing, implementing, and enforcing security standards, governance models, controls, and policies
Strong understanding of secure API design, architecture, authentication, authorization, and risk management
Experience performing threat modeling, security reviews, architecture assessments, and risk evaluations
Proven ability to assess and improve an organization's API security posture
Experience partnering with security, risk, architecture, business, and engineering stakeholders across large enterprise environments
Strong understanding of security frameworks, regulatory requirements, and compliance considerations
Prior hands-on technical experience with application development, APIs, or API technologies
Ability to influence decision-making and drive security initiatives without direct authority
Experience with API gateway technologies such as Apigee, AWS API Gateway, GraphQL gateways, Kong, MuleSoft, or similar platforms
Knowledge of the OWASP API Security Top 10 and common API attack vectors
Experience with OAuth 2.0, OpenID Connect (OIDC), JWT, mTLS, API threat protection, and modern authentication frameworks
Experience supporting API governance programs within financial services or other highly regulated industries
Exposure to API penetration testing, security testing methodologies, and vulnerability management practices
Knowledge of cloud-native application architectures, microservices, and distributed systems
Experience developing enterprise security reference architectures and reusable security patterns
Security certifications such as CISSP, CSSLP, GWAPT, or equivalent
Experience securing modern API ecosystems, including AI APIs and emerging API technologies
Applicants must be able to comply with U.S. Bank policies and procedures including the Code of Ethics and Business Conduct and related workplace conduct and safety policies
Must work from a U.S. Bank location three (3) or more days per week

Benefits

Comp & perks

Healthcare (medical, dental, vision)
Basic term and optional term life insurance
Short-term and long-term disability
Pregnancy disability and parental leave
401(k) and employer-funded retirement plan
Paid vacation (from two to five weeks depending on salary grade and tenure)
Up to 11 paid holiday opportunities
Adoption assistance
Sick and Safe Leave accruals of one hour for every 30 worked, up to 80 hours per calendar year unless otherwise provided by law
Incentive and recognition programs
Equity stock purchase
401(k) contribution and pension