Associate Director, Application Security
S&P GlobalAbout the Role: Grade Level (for internal use): 12 The Team: The SGA Application Security team operates as a strategic security partner, combining Application Security, DevSecOps, Exposure Management, and AI Security capabilities to proactively reduce risk while enabling enterprise innovation. Our collaborative, fast-paced culture emphasizes automation-first approaches, developer partnership, and continuous learning in emerging technologies. As a senior leader, you'll drive enterprise-wide security transformation initiatives, guide AI-powered security innovations, and lead a global team focused on solving complex challenges that impact business growth and cyber resilience. Responsibilities and Impact: Lead execution of the enterprise Application Security strategy and roadmap, driving secure SDLC transformation, platform maturity, and measurable risk reduction across global engineering teams Own and oversee comprehensive application security testing capabilities including SAST, SCA, DAST, API security, threat modeling, and penetration testing while establishing enterprise standards and governance frameworks Drive strategic adoption and operational effectiveness of enterprise AppSec and ASPM platforms, providing executive-ready reporting on coverage, vulnerability trends, and remediation performance Lead software supply chain security initiatives covering dependency governance, artifact curation, provenance validation, and trusted build practices while managing incident response for zero-day exposures Build, mentor, and develop a high-performing global team while managing strategic vendor relationships and driving cross-functional transformation with technology, product, and business leaders Provide leadership in adopting generative AI and agentic technologies within Application Security, establishing governance for custom AI-enabled tools, agents, and automations while ensuring appropriate security and oversight What We're Looking For: Basic Required Qualifications: Demonstrated leadership of enterprise Application Security, DevSecOps, or Product Security programs in complex environments with proven track record of driving transformation Deep knowledge of application testing methodologies, threat modeling, secure architecture, CI/CD security, cloud-native security, and software supply chain risk management Experience defining enterprise standards, operating models, remediation governance, exception processes, and establishing measurable KPIs and KRIs Strong stakeholder management and executive communication skills with ability to translate technical risk into business impact and strategic decisions Experience leading teams, mentoring technical professionals, managing vendor relationships, and driving cross-functional initiatives across global organizations Executive-level communication and presentation capabilities Strategic thinking with ability to balance technical depth and business priorities Strong leadership and team development skills with global mindset Proven ability to influence and drive change across complex organizational structures Additional Preferred Qualifications: Demonstrated knowledge of generative AI, large language models, AI-assisted software development, and practical application of AI technologies to cybersecurity and DevSecOps use cases Strong understanding of Model Context Protocol (MCP), AI agents, agentic architectures, tool calling, retrieval-augmented generation, AI security risks, and governance frameworks for AI integration Experience with multi-cloud security architectures and controls across platforms such as AWS, Azure, and GCP with understanding of cloud-native delivery environments Proven track record in vendor management, contract negotiation, platform roadmap development, and strategic technology partnerships in enterprise security environments Compensation/Benefits Information: (This section is only applicable to US candidates) S&P Global states that the anticipated base salary range for…