Senior InfoSec Lead - Vulnerability & Risk Management

S&P Global, Inc.; New York (NY); On-site; USD 125,000 - 145,000; Full time

Job summary

S&P Global is seeking a Senior Vulnerability Manager to lead enterprise-wide vulnerability management across infrastructure, cloud, and application environments. You will provide strategic oversight, collaborate with cross-functional teams, and drive remediation prioritization aligned with business goals.

The role requires strong expertise in vulnerability assessment frameworks (CVE/CVSS/CWE) and experience with enterprise platforms (Qualys, Tanium, Rapid7), along with hands-on application

Qualifications

• 7+ years of operational security experience in vulnerability management or related fields.
• Deep expertise in CVE, CVSS, CWE and enterprise vulnerability platforms such as Qualys, Tanium, Rapid7, or similar.
• Strong application security knowledge with ability to map vulnerabilities to exploitation techniques and translate findings into actionable recommendations.
• Experience with DAST/SAST tools such as Fortify, Checkmarx, Veracode, or equivalents.

Responsibilities

• Lead enterprise-wide vulnerability management across infrastructure, cloud, and application environments with risk-based prioritization.
• Drive cross-functional collaboration with application teams, IT managers, and business stakeholders to remediate vulnerabilities.
• Develop reporting and metrics programs for executive visibility into security posture and risk trends.
• Mentor junior security professionals and contribute to program maturity through governance and tooling strategy.

Skills

Vulnerability management

Application security testing

Leadership

Stakeholder alignment

Communication

Education

Bachelor's degree

Tools

Qualys

Tanium

Rapid7

Fortify

Checkmarx

Veracode

Power BI

Tableau

Job description

S&P Global is seeking a Senior Vulnerability Manager to lead enterprise-wide vulnerability management across infrastructure, cloud, and application environments. You will provide strategic oversight, collaborate with cross-functional teams, and drive remediation prioritization aligned with business goals.

The role requires strong expertise in vulnerability assessment frameworks (CVE/CVSS/CWE) and experience with enterprise platforms (Qualys, Tanium, Rapid7), along with hands-on application