[Hiring] Lead, Information Security @S&P Global

Role Description

S&P Global Inc. seeks a Lead, Information Security who will:

• Perform security analysis and communicate vulnerabilities identified in web applications with stakeholders, developers, and senior management.
• Provide scoping data to assist in developing project proposals.
• Create detailed assessment reports describing identified security weaknesses, potential business risks, and prioritize mitigation recommendations.
• Develop improved methodologies, processes, infrastructure, tools, and deliverables that contribute to the ongoing enhancement of vulnerability assessment capabilities.
• Gather requirements from Business Analysts and Application Owners.
• Incorporate and define security requirements, map security requirements and define the data flow diagrams, and deliver threat models in the design phase.
• Provide strategic direction and tactical oversight for major security projects, including penetration tests, patch management, change control, application security, and infrastructure security.
• Perform application security assessments for native, web, and hybrid applications using open source and commercial tools.
• Report key metrics to executive management and report on the health of applications and infrastructure components, interacting with application owners and product engineering team to share the assessment results.

Qualifications

• Bachelor’s degree in Computer Science, Computer Engineering, or related IT field.
• 5 years of experience in the job offered or related occupation.

Requirements

• Utilizing enterprise-grade Static Application Security Testing (SAST) tools, including Fortify, to tune rulesets, integrate SAST into complex pipelines, and interpret false positives with accuracy.
• Using Dynamic Application Security Testing (DAST) tools, including Burp Suite Pro and OWASP Zap, to review black-box and gray-box testing efforts, including logic flaw exploitation.
• Managing open-source risk across large codebases, using Mend to perform Software Composition Analysis (SCA), and conducting manual code reviews across multiple programming languages, including Java, Python, C#, and either JavaScript or Node.js.
• Conducting formal threat modeling using frameworks, including STRIDE, PASTA, or MITRE framework, and integrating threat modeling into architectural and design phases of the SDLC.
• Building, scaling, and managing secure SDLC programs in large organizations, including embedding security into CI/CD pipelines using tools such as GitLab CI, Jenkins, GitHub Actions, and Azure DevOps.
• Applying or mapping application security controls to regulations, including DORA, ISO/IEC 27034, NIST 800-53 / SSDF, and SOC 2 Type II and performing remediation efforts or assessments tied to audits and regulatory reviews.
• Application security across distributed product teams, including managing security for hundreds of applications across varied stacks and creating centralized risk dashboards using ServiceNow or similar platforms.
• Scoping, coordinating, and validating results from external/internal pentests and translating test findings into actionable development tasks, prioritizing remediation based on risk.
• Securing applications in multi-cloud environments, including AWS (IAM, Cognito, API Gateway, Lambda) and Azure (App Services, Key Vault, Defender for Cloud), as well as integrating application security tooling and controls within cloud-native CI/CD workflows.

Benefits

• Health & Wellness: Health care coverage designed for the mind and body.
• Flexible Downtime: Generous time off helps keep you energized for your time on.
• Continuous Learning: Access a wealth of resources to grow your career and learn valuable new skills.
• Invest in Your Future: Secure your financial future through competitive pay, retirement planning, a continuing education program with a company-matched student loan contribution, and financial wellness programs.
• Family Friendly Perks: S&P Global has perks for your partners and little ones, too, with some best-in-class benefits for families.
• Beyond the Basics: From retail discounts to referral incentive awards—small perks can make a big difference.