> Markdown version of [/jobs/ext/2697536-lead-information-security-consultant-api-security-governance](https://www.wearedevelopers.com/jobs/ext/2697536-lead-information-security-consultant-api-security-governance). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Lead Information Security Consultant - API Security & Governance

- **Company:** U.S. Bank
- **Location:** Irving, TX, United States
- **Experience:** Expert
- **Salary:** $126,820.0 - $149,200.0
- **Contract:** Permanent contract
- **Skills:** Application Programming Interfaces (APIs), Artificial Intelligence, Applications Architecture, Software System Penetration Testing, User Authentication, Cloud Engineering, Cyber Security, Distributed Systems, OAuth, OpenID, Open Web Application Security, Openid Connect, Software Engineering, Software Vulnerability Management, Enterprise Software Applications, Software Security, Apigee, GWAPT, Graphql, Api Design, Api Gateway, Mulesoft, Vulnerability Analysis, Microservices
- **Published:** September 3, 2026
- **Apply:** https://www.techcareers.com/job.asp?id=3375502611&tx=JP6761FFI&pt=1&aff=0B19D771-A501-4A5E-8338-2A822B784D54&utm_source=Job%20Feed&utm_medium=textkernel&utm_campaign=DE&utm_term=0B19D771-A501-4A5E-8338-2A822B784D54

## About the Role

* 10+ years of experience in Information Security, Application Security, API Security, Security Architecture, or a related field.
 * Deep expertise in API Security and Application Security principles, frameworks, and best practices.
 * Experience developing, implementing, and enforcing security standards, governance models, controls, and policies.
 * Strong understanding of secure API design, architecture, authentication, authorization, and risk management.
 * Experience performing threat modeling, security reviews, architecture assessments, and risk evaluations.
 * Proven ability to assess and improve an organization's API security posture.
 * Experience partnering with security, risk, architecture, business, and engineering stakeholders across large enterprise environments.
 * Strong understanding of security frameworks, regulatory requirements, and compliance considerations.
 * Prior hands-on technical experience with application development, APIs, or API technologies.
 * Ability to influence decision-making and drive security initiatives without direct authority.

Nice to Have Skills:

 * Experience with API gateway technologies such as Apigee, AWS API Gateway, GraphQL gateways, Kong, MuleSoft, or similar platforms.
 * Knowledge of the OWASP API Security Top 10 and common API attack vectors.
 * Experience with OAuth 2.0, OpenID Connect (OIDC), JWT, mTLS, API threat protection, and modern authentication frameworks.
 * Experience supporting API governance programs within financial services or other highly regulated industries.
 * Exposure to API penetration testing, security testing methodologies, and vulnerability management practices.
 * Knowledge of cloud-native application architectures, microservices, and distributed systems.
 * Experience developing enterprise security reference architectures and reusable security patterns.
 * Security certifications such as CISSP, CSSLP, GWAPT, or equivalent.
 * Experience securing modern API ecosystems, including AI APIs and emerging API technologies.

## Description

US Bank is seeking a Lead Information Security Consultant - API Security & Governance to help strengthen and mature API security across the enterprise. This individual will serve as a senior subject matter expert responsible for evaluating and improving the organization's API security posture while ensuring API platforms, programs, and practices align with security standards, regulatory requirements, and industry best practices.

This person will partner closely with Information Security, Technology Risk, Enterprise Architecture, business lines, and technology teams to define security standards, establish governance frameworks, assess risk, and drive secure API adoption across the bank.

Main Responsibilities:

 * Lead the development, maintenance, and evolution of enterprise API security standards, controls, and governance practices.
 * Assess and improve the bank's overall API security posture through security reviews, risk assessments, and control evaluations.
 * Provide guidance on secure API architecture, authentication, authorization, encryption, threat protection, monitoring, and lifecycle management.
 * Partner with Information Security, Technology Risk, Enterprise Architecture, and engineering teams to identify and mitigate API security risks.
 * Conduct architecture reviews, threat modeling exercises, and security assessments for API-enabled applications and platforms.
 * Define and promote API security best practices, reusable security patterns, and governance frameworks across the enterprise.
 * Influence technology teams to adopt secure-by-design API development and implementation practices.
 * Support regulatory, compliance, audit, and risk management activities related to API and Application Security.
 * Serve as a trusted advisor and subject matter expert for API Security and Application Security initiatives.
 * Stay current on emerging API threats, vulnerabilities, technologies, and industry best practices to continuously improve enterprise security capabilities.
 * Collaborate with platform teams supporting Apigee, GraphQL, AI APIs, AWS API Gateway, and other API technologies to ensure security requirements are consistently applied.
 * Drive alignment between business objectives, security requirements, and enterprise technology standards.


## Related Videos

- [Keeping applications secure by evolving OAuth 2.0 and OpenID Connect](https://www.wearedevelopers.com/videos/100152-keeping-applications-secure-by-evolving-oauth-2-0-and-openid-connect)
- [Lessons learned from observing a billion API requests](https://www.wearedevelopers.com/videos/1574-lessons-learned-from-observing-a-billion-api-requests)
- [Get started with securing your cloud-native Java microservices applications](https://www.wearedevelopers.com/videos/123-get-started-with-securing-your-cloud-native-java-microservices-applications)
- [Delay the AI Overlords: How OAuth and OpenFGA Can Keep Your AI Agents from Going Rogue](https://www.wearedevelopers.com/videos/1637-delay-the-ai-overlords-how-oauth-and-openfga-can-keep-your-ai-agents-from-going-rogue)
- [Architecting API Security](https://www.wearedevelopers.com/videos/377-architecting-api-security)
- [Delegating the chores of authenticating users to Keycloak](https://www.wearedevelopers.com/videos/1558-delegating-the-chores-of-authenticating-users-to-keycloak)

## Related Articles

- [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities)
- [Got AI ideas but no money? Here are 10 free ways to level up your AI skills with Google Cloud](https://www.wearedevelopers.com/magazine/600-got-ai-ideas-but-no-money-here-are-10-free-ways-to-level-up-your-ai-skills-with-google-cloud)
- [Why Upskilling And Reskilling is Important For Developers](https://www.wearedevelopers.com/magazine/428-why-upskilling-and-reskilling-is-important-for-developers)
- [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed)
- [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking)
- [The 12 Best Jobs for Software Engineers](https://www.wearedevelopers.com/magazine/401-the-12-best-jobs-for-software-engineers)