The Principal Product Security Engineer will serve as a senior individual contributor responsible for defining, maturing, and integrating Secure Software Development Lifecycle (Secure SDLC) practices into Navy Federal’s software delivery environment. This role leads cross-team integration to embed product security expectations into workflows, governance, delivery processes, and lifecycle activities.
Secure SDLC Leadership and Integration
Define and mature Secure SDLC practices aligned to Navy Federal software delivery processes, operating models, and secure development practices. Serve as the senior integration lead for embedding Secure Development Practice capabilities into engineering workflows, governance forums, and lifecycle activities. Provide support for integrating secure development expectations into architecture governance, delivery boards, exception processes, and lifecycle risk decision points.
Pre-Production Product Security Risk Communication
Define and support a pre-production product security scorecard to enable risk-informed release decisions. Ensure product security posture, open risks, exceptions, and required remediation actions are communicated clearly to business and technology stakeholders.
Mapping Security Activities to the Delivery Lifecycle
Map product security activities to software delivery processes spanning intake, planning, architecture review, design, development, testing, release, exception management, and operational handoff. Establish repeatable process patterns that integrate threat modeling, secure coding, application security testing, software composition analysis, API security, software supply chain security, product integrity testing, and risk-based exception handling into engineering workflows.
Process Improvement and Reducing Friction
Identify and reduce redundant reviews, unclear handoffs, late-stage security friction, and legacy process steps that do not align with Navy Federal software delivery practices. Recommend process improvements that strengthen security outcomes, improve developer experience, increase risk visibility, and enable secure delivery at scale.
Operating Models, Documentation, and Enablement Assets
Develop Secure SDLC operating models, workflow diagrams, playbooks, process documentation, RACI models, control integration points, and implementation guidance. Translate security standards, objectives, and risk expectations into practical engineering requirements and developer-consumable guidance.
Collaboration Across Security and Engineering Stakeholders
Partner with software engineering, architecture, DevSecOps, Information Security, governance, and risk stakeholders to align secure development practices with enterprise delivery processes. Lead cross-functional working sessions, develop executive-ready recommendations, and influence process decisions across security and engineering stakeholders without direct authority.
Adoption and Effectiveness Measures
Establish adoption and effectiveness measures to demonstrate Secure SDLC maturity, control integration, developer enablement, reduced friction, and improved product security outcomes.
Required Qualifications
- Bachelor’s degree in information technology, Cybersecurity, Computer Science, Software Engineering, Information Systems, Engineering, or related field, or the equivalent combination of education, training, and experience.
- Experience defining, improving, or integrating secure development lifecycle practices into enterprise software delivery processes.
- Strong understanding of secure development practices including threat modeling, secure coding, application security testing, software composition analysis, API security, software supply chain security, vulnerability management, and risk-based exception handling.
- Extensive hands-on experience translating security requirements, control objectives, or risk expectations into practical engineering processes, workflow guidance, and delivery requirements.
- Demonstrated experience developing process documentation, operating models, workflow diagrams, playbooks, standards, RACI models, implementation guidance, or executive-level recommendations.
- Strong facilitation, analytical thinking, systems thinking, problem-solving, communication, and stakeholder influence skills.
- Ability to operate independently as a senior individual contributor and lead complex cross-functional initiatives without direct reporting authority.
Desired Qualifications
- Extensive hands-on experience in application security, secure SDLC, software engineering, DevSecOps, enterprise architecture, technology risk, or software delivery governance.
- Strong understanding of software delivery practices including Agile, SAFe, DevOps, DevSecOps, CI/CD, product-oriented delivery, architecture governance, and release management.
- Advanced degree in Information Technology, Cybersecurity, Computer Science, Software Engineering, Information Systems, Engineering, Business Administration, or related field.
- Experience with industry frameworks or models such as NIST Secure Software Development Framework, OWASP SAMM, OWASP ASVS, OWASP Top 10, BSIMM, ISO 27001, NIST Cybersecurity Framework, or similar security and software assurance practices.
- CISSP, CISM, CSSLP, CCSP, GIAC, cloud security, architecture, Agile, SAFe, or related professional certifications.
Work Schedule
Monday through Friday, 8:00AM to 4:30PM.
Location
Onsite locations include 820 Follin Lane, Vienna, VA 22180; 5510 Heritage Oaks Drive, Pensacola, FL 32526; and 141 Security Drive, Winchester, VA 22602.
Bank Secrecy Act
Remains cognizant of and adheres to Navy Federal policies and procedures, and regulations pertaining to the Bank Secrecy Act.
