S&P Global - Washington, DC
posted 4 months ago
The Director of Application Security Engineering at S&P Global is a senior-level position responsible for leading a team of security engineers and analysts to develop and implement security architecture and engineering best practices across S&P Ratings technology platforms. The primary mission of the S&P Ratings Security team is to protect clients and users from modern-day security threats by safeguarding systems and data through innovative solutions. This role requires a combination of managerial and technical capabilities, focusing on driving the Secure Software Development Life Cycle (SDLC) roadmap and Cloud security architecture. The successful candidate will work closely with software development, QA, SRE, and Operations teams to identify technical risks, evaluate critical failure points, and implement security controls to mitigate risks while aligning with application development timelines. In this role, the Director will provide architectural guidance on best practices regarding security in software development, shared services, and user interface design frameworks. They will also be responsible for developing, implementing, and maintaining application security and GenAI security strategies, performing threat modeling, secure code reviews, and secure design reviews for high-risk applications. The Director will serve as a technical security advisor for new technology and applications developed by S&P Ratings, guiding development and SRE teams in building secure Cloud Native applications by incorporating best practices and industry standards. This position also involves mentoring team members, developing security tooling, and consulting on security incident response processes. The Director will play a crucial role in ensuring that security is integrated into the development process and that the organization is prepared to respond to security incidents effectively. They will also be responsible for maintaining knowledge of current and emerging technologies related to security architectural solutions and developing repeatable application security patterns to ensure systems are placed within the relevant security zones based on the data they house and their purpose.