Manager - API Security

We are the movers of the world and the makers of the future. We get up every day, roll up our sleeves and build a better world -- together. At Ford, we're all a part of something bigger than ourselves. Are you ready to change the way the world moves?

Enterprise Technology plays a critical part in shaping the future of mobility. If you're looking for the chance to leverage advanced technology to redefine the transportation landscape, enhance the customer experience and improve people's lives, this is the opportunity for you. Join us and challenge your IT expertise and analytical skills to help create vehicles that are as smart as you are.

At Ford Motor Company, secure APIs are essential to protecting our customers, vehicles, partners, and connected services. We are seeking a dedicated technical and people leader to join our Product Cybersecurity organization as the Manager of the API Security team.

This is a unique opportunity to lead a specialized team responsible for defining the security architecture, standards, and strategy for APIs connecting Ford's vehicle, application, cloud, and partner ecosystems. You will help engineering teams build secure services through practical authentication and authorization patterns, clear security requirements, and scalable review and exception processes. Reporting to the Director of Offboard Cybersecurity Architecture & Strategy, you will develop your team, strengthen cross-functional partnerships, and drive measurable improvements in API security across Ford's connected products and services.

What you'll do...

• Mentor, develop, and lead a high-performing team of API cybersecurity architects and engineers, establishing clear expectations, providing regular coaching and performance feedback, and fostering a collaborative culture of ownership and accountability.
• Define and execute the API cybersecurity roadmap, aligning team priorities, capacity, and commitments with Ford's connected-product strategy, business needs, and the broader Offboard Cybersecurity mission.
• Own and maintain API security standards and implementation guidance for authentication, authorization, token protection, secure communications, and third-party integrations.
• Lead risk-based security architecture reviews for API integrations, engaging product and platform teams before design freeze to establish clear requirements and address security gaps early.
• Guide threat modeling and technical risk assessments for critical API use cases
• Own the API security exception workflow, including intake, technical assessment, recommendations, documentation, renewal, and closure. Improve consistency and automate low-risk, repeatable reviews while escalating material risks to accountable product and business leaders through established risk-acceptance processes.
• Drive the development and adoption of reusable API security patterns, review checklists, and developer guidance that reduce recurring vulnerabilities and the need for custom exceptions.
• Serve as the primary API cybersecurity interface for product, engineering, platform, and partner-integration teams. Work across Application Security, Enterprise Cybersecurity, Identity and Access Management, and other Product Cybersecurity teams to clarify responsibilities, resolve technical trade-offs, and maintain effective partnerships.
• Establish meaningful metrics for review timeliness, exception trends, recurring control gaps, and adoption of approved patterns. Communicate priorities, delivery commitments, and security recommendations clearly, and escalate incomplete requests, late engagement, or capacity constraints early.
• Lead continuous improvement of team processes, tools, and work products, including evaluating AI-assisted reviews and automation to improve quality, consistency, efficiency, and the developer experience. Deliver practical API security training and outreach at least quarterly.
• Support Privacy, Legal, and Compliance partners with API security requirements and review evidence.
• Partner with Monitoring teams to establish an ongoing, bidirectional information exchange on API exposures, emerging attack patterns, newly approved architectural patterns, and known exceptions, ensuring runtime findings continuously inform architecture standards and new design patterns drive updated detection coverage.

You'll have...

• Bachelor's degree in Cybersecurity, Computer Science, Software Engineering, Computer Engineering, or a related field OR a combination of education and experience.
• 5+ years of experience in cybersecurity, including hands-on experience in API security, application security, or security architecture for cloud-connected services.
  • Strong understanding of API authentication and authorization, including OAuth 2.0, OpenID Connect, token security, and common API vulnerabilities such as broken object-level and function-level authorization.
  • Experience with threat modeling, security architecture reviews, and translating identified risks into actionable requirements and mitigation recommendations.
  • Experience developing security standards, architecture patterns, or technical guidance for software engineering teams, with working knowledge of REST APIs, HTTP, TLS, and cloud service architectures.
• 3+ years of formal or informal leadership experience, including developing technical talent, guiding teams, setting priorities, and delivering cross-functional projects.
  • Strong communication and collaboration skills, with the ability to explain complex security issues, make clear recommendations, and influence technical and non-technical stakeholders.

Even better, you may have...

• Master's degree in a relevant technical or cybersecurity field.
• Proven track record of building or leading high-performing technical security teams in a large, global organization, including coaching, performance management, and talent development.
• Deep experience designing secure authorization across customer, vehicle, service-to-service, and partner integrations, including multi-tenant access controls, delegated access, and token lifecycle protection.
• Experience with API discovery, posture management, security testing, API gateways, and integrating security controls and feedback into CI/CD and developer workflows.
• Experience improving security exception processes through risk-based prioritization, workflow automation, and measurable reduction of recurring control gaps.
• Experience securing connected-vehicle, mobility, IoT, or other cloud-connected product ecosystems, including familiarity with automotive cybersecurity standards such as ISO/SAE 21434.
• Experience establishing cross-functional working models with product engineering, enterprise cybersecurity, identity teams, and security operations, and delivering practical developer training and reusable guidance.

You may not check every box, or your experience may look a little different from what we've outlined, but if you think you can bring value to Ford Motor Company, we encourage you to apply!

As an established global company, we offer the benefit of choice. You can choose what your Ford future will look like: will your story span the globe, or keep you close to home? Will your career be a deep dive into what you love, or a series of new teams and new skills? Will you be a leader, a changemaker, a technical expert, a culture builder…or all of the above? No matter what you choose, we offer a work life that works for you, including:

• Immediate medical, dental, vision and prescription drug coverage
• Flexible family care days, paid parental leave, new parent ramp-up programs, subsidized back-up child care and more
• Family building benefits including adoption and surrogacy expense reimbursement, fertility treatments, and more
• Vehicle discount program for employees and family members and management leases
• Tuition assistance
• Established and active employee resource groups
• Paid time off for individual and team community service
• A generous schedule of paid holidays, including the week between Christmas and New Year's Day
• Paid time off and the option to purchase additional vacation time.

For a detailed look at our benefits, click here: https://fordcareers.co/LL6

This position is Leadership Level 6 | $132,800 - $250,800

*Note: This is a hybrid role, you are expected to relocate if you are not within commutable distance, and responsible to be on site 4 days a week

Visa sponsorship is not available for this position.

Candidates for positions with Ford Motor Company must be legally authorized to work in the United States. Verification of employment eligibility will be required at the time of hire.

We are an Equal Opportunity Employer committed to a culturally diverse workforce. All qualified applicants will receive consideration for employment without regard to race, religion, color, age, sex, national origin, sexual orientation, gender identity, disability status or protected veteran status. In the United States, if you need a reasonable accommodation for the online application process due to a disability, please call 1-888-336-0660.

#LI-Hybrid

#LI-AH1