Information Security Engineer II

Make banking a Fifth Third better®

We connect great people to great opportunities. Are you ready to take the next step? Discover a career in banking at Fifth Third Bank.

Please note that this position is not available for immigration sponsorship

OUR ORGANIZATION'S OBJECTIVE: We get shift done by simplifying the protection of application, data, cloud assets, and containers for application teams allowing them to Advance the Bank.

OUR ORGANIZATION'S STRATEGY: Strengthen API security by enabling effective and scalable protection through standardized patterns, automation, and modern security tooling - ensuring secure-by-design APIs across the development lifecycle

WHAT OUR ORGANIZATION VALUES:

• Adaptability
• Collaboration
• Deep Technical Curiosity

LOCATION: Remote (flexible EST hours). Team primarily located in Cincinnati, OH. Travel (if remote) expected 1 week per quarter.

JOB OVERVIEW:

As an Information Security Engineer II, you will play a key role in securing APIs across cloud and hybrid environments. You’ll work hands-on with engineering teams to implement, integrate, and maintain API security controls, contributing to the protection of critical services and data. This role is ideal for someone with a strong technical foundation in security engineering, a passion for automation, and experience with modern DevSecOps practices.

GENERAL FUNCTION:

The Information Security Engineer (ISE) II will be responsible for defining, delivering and supporting the enterprise security tools and architecture developed in collaboration with the IT Engineering team. The ISE will also participate in a diverse variety of IS projects and support the ongoing operations of the Information Security department. The ISE is focused on securing the network through the operations of intrusion detection system/intrusion prevention system (IDS/IPS), data loss prevention (DLP), Proxy, enterprise anti-virus and anti-malware solutions, log management, and vulnerability scanning and remediation.

Responsible and accountable for risk by openly exchanging ideas and opinions, elevating concerns, and personally following policies and procedures as defined. Accountable for always doing the right thing for customers and colleagues, and ensures that actions and behaviors drive a positive customer experience. While operating within the Bank's risk appetite, achieves results by consistently identifying, assessing, managing, monitoring, and reporting risks of all types.

What You Will Do

API Security Engineering & Implementation

• Support API security controls including API gateways, authentication/authorization mechanisms, and runtime protection tools.
• Integrate API security scanning tools (e.g., 42Crunch, Noname, Traceable) into CI/CD pipelines to detect and remediate vulnerabilities early in the SDLC.
• Support runtime defense mechanisms to monitor and block malicious API traffic in real time.

Vulnerability Management & Remediation

• Conduct API vulnerability assessments using automated tools and manual techniques.
• Collaborate with development teams to remediate findings related to the OWASP API Security Top 10.
• Track and verify remediation efforts, ensuring timely closure of security gaps.

Threat Detection & Risk Analysis

• Analyze API traffic patterns and telemetry to identify anomalies, abuse, and potential threats.
• Support threat modeling and risk assessments for new and existing APIs.
• Contribute to the development of detection rules and alerting logic for API-related threats.

Automation

• Develop scripts and integrations to streamline security operations and improve response times.
• Support infrastructure-as-code (IaC) security practices for API deployments.

Agile Collaboration & Continuous Improvement

• Stay current on API security trends, threat landscapes, and emerging technologies.

ESSENTIAL DUTIES & RESPONSIBILITIES:

• Mentor more junior members of the team.
• Contribute to and enhance the bank's network vulnerability management program.
• Define security requirements for the implementation of new applications and projects.
• Serve as a security engineer/consultant on projects.
• Participate in conducting security research on threats and remediation techniques/ technology, make recommendations to the IS/IT teams and oversee their implementation.
• Support the Bank's operational information security responsibilities, including the development maintenance of standards, procedures, and guidelines necessary to satisfy the Information Security department's network operations.
• Proactively monitor and investigate network security alerts from managed security service provider and in-house security tools.
• Assist in conducting risk assessments to evaluate the effectiveness of existing controls and determine the impact of proposed changes to business processes, applications and systems.
• Provide technical support to regulatory agencies, external auditors, and internal auditors, as required, to respond to audits and examinations of the Bank's control environment.
• Threat analysis / Incident Response: interpreting events and analyzing network traffic.
• Mitigating and addressing threat vectors including APT, DDoS, Phishing, Malicious Payload, Cloud, Mobile Devices.
• Vulnerability/penetration testing/remediation.
• Seeking and maintaining knowledge (cross/up skill) of current and upcoming IT security technologies.
• Awareness of latest and common security threats.
• Knowledge of virtualization technologies.
   

SUPERVISORY RESPONSIBILITIES: None.

MINIMUM KNOWLEDGE, SKILLS, & ABILITIES REQUIRED:

• Bachelor's degree in Computer Science/Information Systems or equivalent combination of education and experience. Master's degree a plus.
• Industry Standard Certifications such as, but not limited to: CompTIA A+, CompTIA Network +, CompTIA Security +, ISC2 CISSP, and EWS are preferred.
• Must be able to communicate ideas both verbally and in writing to management, business and IT sponsors, and technical resources in language that is appropriate for each group.
• At least 2 years of related experience; 1+ years experience in a hands-on information security development role preferred.
• Experience working with and supporting Unix/Linux and Windows systems.
• Solid conceptual understanding of distributed computing principles.
• Working knowledge of application and data security concepts, best practices, and common vulnerabilities.
• Previous experience working with offshore teams desired.
• Financial industry experience is a plus.
• Excellent ability to diagnose and troubleshoot accessibility issues.

ADDITIONAL KEY KNOWLEDGE, SKILLS, & ABILITIES REQUIRED:

• Experience with automated testing frameworks and practices
• Familiarity with serverless architectures (e.g., AWS Lambda)
• Knowledge of containerization technologies such as Docker or Kubernetes
• Exposure to API gateways (e.g., Amazon API Gateway, Kong)
• Hands-on experience with Amazon Web Services (AWS)
• Experience in Terraform for infrastructure as code
• Strong programming skills in Python
• Experience in API development and integration

Fifth Third Bank, National Association is proud to have an engaged and inclusive culture and to promote and ensure equal employment opportunity in all employment decisions regardless of race, color, gender, national origin, religion, age, disability, sexual orientation, gender identity, military status, veteran status or any other legally protected status.