This role pays more than
52%
of similar roles. Most pay
$172,935–$235,500
— the shaded band above.
At the midpoint, this role pays about
$208k
versus about
$204k
for comparable roles.
Based on 240 similar postings.
Employer
About Synchrony
Synchrony is a premier consumer financial services company and one of the nation’s largest providers of private-label and co-branded credit cards, alongside promotional financing and FDIC-insured savings products.
As a VP, Product Security Architecture, you will provide enterprise-level leadership for the product security architecture function across an application and SaaS ecosystem. You will lead the definition of an Application Security Blueprint, establishing reference architectures, approved patterns, and engineering guardrails to ensure software is secure-by-design. Your daily responsibilities include managing architecture governance, performing design reviews, conducting threat modeling at scale, and standardizing API security for distributed systems and cloud-native applications. You will also manage a team of architects while partnering with product leaders to integrate security into the SDLC. Key technical requirements include expertise in authentication, authorization, cryptography, mTLS, secrets management, and identity federation via SAML/OIDC. The role addresses complex challenges in regulated environments, translating requirements like PCI-DSS, GDPR, and SOC 2 into actionable designs for high-risk initiatives and service-to-service communications.
Establish the strategic vision, operating model, and multi-year roadmap for enterprise application and product security.
Develop and maintain the Application Security Blueprint including reference architectures, reusable patterns, and engineering guardrails.
Lead architecture governance by performing design reviews, establishing review criteria, and managing risk acceptance for exceptions.
Drive threat modeling at scale by defining methodologies and facilitating sessions for high-risk initiatives to identify trust boundaries and data flows.
Standardize security architectures for APIs and distributed systems, including authentication, authorization, mTLS, and secrets management.
Translate regulatory requirements like PCI-DSS and GDPR into actionable technical security designs for infrastructure and application teams.
Manage a team of Security Architects by providing strategic direction, coaching, and mentoring to foster a security-first culture.
Develop and report key performance indicators and risk metrics to executive leadership to demonstrate business impact and security maturity.
What we're looking for
10+ years of experience in security architecture and engineering with a focus on application and product security.
Proven ability to provide enterprise-level leadership by setting standards, driving adoption, and aligning stakeholders.
Strong hands-on knowledge of authentication, authorization, cryptography, secrets management, and secure data handling.
Experience leading threat modeling and producing high-quality architecture artifacts like DFDs and risk assessments.
Expertise in API security, including common web risks such as OWASP Top 10 and API Security Top 10.
Experience securing SaaS applications using SSO/federation (SAML/OIDC) and managing tenant isolation.
Proficiency in DevSecOps practices, CI/CD controls, and software supply chain security.
CISSP, CCSP, or CSSLP certifications are preferred.
Artificial Intelligence
Cybersecurity
Cloud Services
Knowledge Graphs
Distributed Systems
Release Governance
Incident Management
Service Health Reviews
Data Science