Tech Risk, Governance & Controls Leader

S&P Global; Charlottesville (VA); Hybrid; USD 220,000 - 350,000; Full time

Job summary

S&P Global in New York, NY, seeks Head of Technology Risk, Governance, and Controls to own first-line risk across the technology organization. You will design and operate controls, manage SOX ITGC testing, and collaborate with Internal Audit, Enterprise Risk, and Information Security.

The role requires expertise in NIST CSF, ISO 27001, COBIT, data privacy, and AI risk, with the ability to explain complex risk topics to executives and tech teams while driving a culture of continuous improvement.

Qualifications

• Minimum of 15 years of experience in technology risk management and internal controls implementation.
• Strong stakeholder relationship acumen to navigate issue resolution and urgency.

Responsibilities

• Lead the technology risk and governance strategy by driving risk initiatives.
• Own annual IT SOX controls testing and remediation with Finance, Internal Audit, and External Auditor.
• Scale and optimize the first-line of defense to identify and mitigate technology risk across the firm.
• Collaborate with Enterprise Risk and Compliance to design and operate technology controls.
• Operationalize the enterprise risk framework within technology and coordinate with information security.
• Establish and track KPIs/KRIs related to technology risk and compliance across all tech teams.
• Integrate risk management into strategic planning, product development, and operations.
• Drive a culture of risk awareness and continuous improvement.

Skills

Technology risk management

SOX controls

Internal controls

GRC platforms

Vendor risk

AI risk management

Regulatory compliance

Tools

ServiceNow GRC

Archer

Job description

S&P Global in New York, NY, seeks Head of Technology Risk, Governance, and Controls to own first-line risk across the technology organization. You will design and operate controls, manage SOX ITGC testing, and collaborate with Internal Audit, Enterprise Risk, and Information Security.

The role requires expertise in NIST CSF, ISO 27001, COBIT, data privacy, and AI risk, with the ability to explain complex risk topics to executives and tech teams while driving a culture of continuous improvement.