Overview

Grade Level (for internal use): 11

Responsibilities

• Enterprise-scale ownership: Lead end-to-end delivery of security controls across GitHub Enterprise, GitHub Actions, OIDC, Checkmarx, SonarQube, Wiz, Artifactory/Xray, Vault, Okta/SailPoint and Splunk.
• Emerging technology: Shape governance for AI-assisted development (Copilot controls, MCP, agent guardrails) and software supply chain security (SBOM, signing, SLSA).
• Visibility and influence: Engage directly with senior leaders and auditors on high-profile initiatives tied to company strategy, across frameworks including SOX, SOC 2, ISO 27001 and NIST SSDF.
• Growth: Build and grow a team, and access innovation projects, training, knowledge sharing and support for security certifications such as CISSP, CISM and CSSLP.
• Own the SDLC security strategy, policy framework and roadmap, aligned with InfoSec and audit requirements.
• Lead, mentor and grow a team of DevSecOps engineers, and drive delivery of toolchain hardening programmes.
• Report on security posture, risk and remediation progress to senior stakeholders.
• Partner with platform, SRE and engineering leaders to ensure controls are automated, sustainable and widely adopted.
• Define and implement baseline security policies and automated guardrails across source control and CI/CD environments.
• Integrate, manage and tune code quality and application security tools, including SonarQube, Checkmarx and Wiz, within developer workflows.
• Harden build infrastructure and software supply chain controls, including artifact management with JFrog Artifactory/Xray.
• Provision, secure and optimise AWS services supporting the developer platform, including EC2, ECS/EKS, Lambda, S3, IAM and CloudFormation/CDK.
• Lead security architecture reviews and incident response for toolchain security events.
• Govern application security and supply chain tooling, including exception management and remediation service-level agreements (SLAs).
• Triage security findings, prioritise vulnerabilities by risk and track remediation to closure.
• Establish governance for credentials, secrets and non-human identities across the developer toolchain.
• Define governance for AI-assisted development tools and developer endpoint security.
• Monitor sensitive configuration changes, implement alerting and own audit readiness and compliance evidence.

Qualifications

• 8+ years of experience in DevSecOps, application security or security engineering, including leading teams or programmes.
• Proven ability to define security policy and standards, translate them into technical enforcement, and drive adoption across a large organisation.
• Strong knowledge of compliance frameworks (e.g., SOX, SOC 2, ISO 27001) and identity governance.
• Excellent communication and stakeholder management skills, with the ability to influence engineering teams and senior leaders.
• Deep expertise in designing, automating and securing enterprise-scale CI/CD pipelines, including common pipeline and source control threats.
• Hands-on knowledge of GitHub Enterprise Cloud, GitHub Actions, runners, rulesets and policies.
• Strong understanding of repository lifecycle management and Git practices, including Conventional Commits, semantic versioning, trunk-based development/GitFlow and pull request workflows.
• Hands-on experience with static application security testing (SAST), software composition analysis (SCA), secrets scanning and cloud security tooling.
• Knowledge of identity and access management, including single sign-on (SSO), role-based access control (RBAC) and least privilege.
• Proficiency with infrastructure as code (Terraform, CloudFormation or CDK) and familiarity with configuration management tools.
• Experience with AWS compute, networking, storage, IAM and container orchestration (ECS/EKS), including AWS security best practices.
• Strong scripting and automation skills in Python or Bash; familiarity with TypeScript/Node.js.
• Understanding of configuration management databases (CMDBs) and ITIL-aligned change management, including approvals and audit trails.
• Awareness of AI tool governance and developer endpoint security, including mobile device management (MDM).
• Bachelor’s degree or higher in Computer Science, Information Security or a related technology field, or equivalent practical experience.
• What’s In It For You?
• Our Mission:
• Advancing Essential Intelligence.
• Our People:
• Our Values:
• Integrity, Discovery, Partnership
• Throughout our history, the world's leading organizations have relied on us for the Essential Intelligence they need to make confident decisions about the road ahead. We start with a foundation of integrity in all we do, bring a spirit of discovery to our work, and collaborate in close partnership with each other and our customers to achieve shared goals.

Nice to have

• Experience with AI-assisted development tools such as GitHub Copilot and Cursor, and with developer agents/MCP integrations.
• Contributions to open-source Backstage plugins or internal developer platform (IDP) ecosystems.
• Familiarity with compliance as code and policy engines such as OPA or Sentinel.
• Experience with software supply chain frameworks and practices such as SLSA, SBOM generation and artifact signing.
• Security certifications such as CISSP, CISM, AWS Certified Security – Specialty.
• Cloud or Kubernetes certifications such as AWS Solutions Architect, AWS DevOps Engineer, CKA or CKAD.

Benefits

• Health & Wellness: Health care coverage designed for the mind and body.
• Flexible Downtime: Generous time off helps keep you energized for your time on.
• Continuous Learning: Access a wealth of resources to grow your career and learn valuable new skills.
• Invest in Your Future: Secure your financial future through competitive pay, retirement planning, a continuing education program with a company-matched student loan contribution, and financial wellness programs.
• Family Friendly Perks: It’s not just about you. S&P Global has perks for your partners and little ones, too, with some best-in class benefits for families.
• Beyond the Basics: From retail discounts to referral incentive awards—small perks can make a big difference.
• ---------------------------------------------------------
• ---------------------------------------------------------