Open security roles at Navy Federal Credit Union, and what we know about the team behind them.
financial services · 26000 employees · 3 open roles. Updated October 16, 2026.
Navy Federal Credit Union
“"Our responsibilities include incident detection and response, penetration testing, application...”
Navy Federal Credit Union
“"Our responsibilities include incident detection and response, penetration testing, application...”
Navy Federal Credit Union
“"Our responsibilities include incident detection and response, penetration testing, application...”
Compiled from public job postings, careers pages, and company materials. Data may not reflect current state — verify during interviews.
How they approach application security
The team
Org Structure & Reporting Line: "Our responsibilities include incident detection and response, penetration testing, application security"( interpretation: CISO lists application security within his remit). Key Public-Facing Leaders: Mike Newborn, Chief Information Security Officer. Key Quote: "If security becomes a blocker, you've lost the room. Active AppSec Job Postings (as_of:): Count: At least 3 AppSec-related postings identified (internships and job listings). Common Skill/Tool Patterns: Job postings emphasize Security Champions, standards/controls, and security governance knowledge (NIST/FFIEC references in job descriptions). Specific AppSec tool names (SAST/SCA/DAST) are not listed in public job postings. Gaps & Contradictions: No public org chart or reporting-chain document found. Team size and dedicated AppSec headcount are not publicly available
What they're working on
Security Champions Program: Status: Evidence Found. "The Security Champions Program provides development teams support to incorporate application security activities". "Support Navy Federal's Security Champions Program by coordinating activities". Vulnerability Management Process: Intake: "Discovered a Site Vulnerability? Report It Here". Secure SDLC Artifacts: "documented security requirements in NFCU's Security Standards". "enabling the business, helping to develop secure, quick-to-market products". Recent Initiatives (Last 6 Months): No public evidence of distinct new AppSec tool rollouts or policy changes in the last six months. Gaps & Contradictions: No public, detailed descriptions of AppSec operational workflows (CI/CD integration, SAST/SCA tool lists, triage SLAs, or remediation ownership). Specific shift-left technical practices and toolchain evidence are not available publicly