Greedy regex quantifier not matching password criteria

/(^[a-zA-Z]+-?[a-zA-Z0-9]+){5,15}$/g

regex criteria
match length must be between 6 and 16 characters inclusive
must start with a letter only
must contain letters, numbers and one optional hyphen
must not end with a hyphen

the above regular expression doesnt satisfy all 4 conditions. tried moving the ^ before the group and omitting the + quantifiers but doesnt work