Lead Information Security Strategist — Cloud & AppSec

S&P Global Inc.; New York (NY); Remote; USD 173,000 - 206,000; Full time

Benefits offered by this job

Health & Wellness

Flexible Downtime

Continuous Learning

Invest in Your Future

Family Friendly Perks

Beyond the Basics

Job summary

S&P Global Inc. is seeking a Lead, Information Security to oversee security analysis, vulnerability management, and threat modeling across our applications and infrastructure.

You will engage stakeholders, developers, and senior leadership to define risks and prioritise mitigations. The role requires hands‑on security leadership, extensive experience with SAST/DAST tools, and the ability to drive secure SDLC practices in a large, multi‑cloud environment.

Qualifications

• Bachelor’s degree plus 5 years of related experience.
• Experience with SAST/DAST tools and interpreting results.
• Knowledge of threat modeling frameworks STRIDE/PASTA/MITRE.
• Experience embedding security into CI/CD pipelines.
• Ability to communicate risks to stakeholders.

Responsibilities

• Perform security analysis and communicate vulnerabilities identified in web applications with stakeholders, developers, and senior management.
• Provide scoping data to assist in developing project proposals.
• Create detailed assessment reports describing identified security weaknesses, risk, and mitigation priorities.
• Develop improved methodologies, processes, infrastructure, tools and deliverables for vulnerability assessment capabilities.
• Gather requirements from Business Analysts and Application Owners.
• Define security requirements and map data flows; deliver threat models in the design phase.
• Provide strategic direction and oversight for major security projects including pentests and patch management.
• Conduct application security assessments for native, web, and hybrid apps using open source and commercial tools.
• Report metrics on health of applications and infrastructure to executive management.

Skills

Threat modeling

Security architecture

Vulnerability management

Stakeholder communication

Security governance

Education

Bachelor's degree in Computer Science/Engineering or related IT field

Tools

Fortify

Burp Suite Pro

OWASP ZAP

Mend

GitLab CI

Jenkins

GitHub Actions

Azure DevOps

AWS

Azure

Job description

S&P Global Inc. is seeking a Lead, Information Security to oversee security analysis, vulnerability management, and threat modeling across our applications and infrastructure.

You will engage stakeholders, developers, and senior leadership to define risks and prioritise mitigations. The role requires hands‑on security leadership, extensive experience with SAST/DAST tools, and the ability to drive secure SDLC practices in a large, multi‑cloud environment.