Application Security Lead

S&P Global is seeking an Application Security Lead to drive complex application security programs across the enterprise. This role provides technical leadership, integrates security into developer workflows, and designs AI-enabled Application Security capabilities aligned with enterprise governance.

Location

Princeton, NJ (onsite)

Compensation

USD 120,000 - 150,000 per year.

(US candidates) S&P Global states that the anticipated base salary range for this position is $120,000 to $150,000. Final base salary will be based on geographic location, experience level, skill set, training, licenses and certifications.

Key Responsibilities

• Lead complex application security assessments using multiple testing methodologies, including SAST, SCA, DAST, API security, secrets detection, and threat modeling to identify and mitigate vulnerabilities.
• Drive integration of security controls into developer workflows across GitHub, Azure DevOps, Jenkins, and cloud-native platforms, implementing risk-based quality gates to strengthen secure coding practices.
• Conduct comprehensive threat modeling and security design reviews for new applications, APIs, and cloud services, providing strategic guidance for secure architecture decisions.
• Design and implement AI-enabled Application Security capabilities, including custom tools, agents, and automations that improve security testing, triage, and remediation while meeting enterprise governance standards.
• Collaborate with cross-functional partners across engineering, product, cloud, and risk to address systemic application risks and establish scalable security controls across the SDLC.
• Provide technical leadership and mentoring to security analysts and engineering partners, and contribute to enterprise standards, procedures, and audit-ready documentation.

Required Qualifications

• Bachelor's degree in Cybersecurity, Computer Science, Engineering, or related field, or equivalent professional experience.
• 6+ years of experience in Application Security, DevSecOps, secure software engineering, or penetration testing with hands-on technical expertise.
• Strong knowledge of application security testing methodologies, including SAST, SCA, DAST, threat modeling, secure design principles, and CI/CD security practices.
• Experience integrating security controls into development platforms such as GitHub, Azure DevOps, Jenkins, and cloud-native delivery environments.
• Practical experience using generative AI and AI-assisted development tools to build custom security tools, scripts, integrations, or automations.
• Ability to lead technical engagements, communicate complex security risks to senior stakeholders, and drive remediation across distributed engineering teams.
• Strong analytical and problem-solving skills with attention to detail.
• Excellent communication and presentation skills for technical and non-technical audiences.
• Leadership and mentoring capabilities, with a collaborative team approach.
• Adaptability to work in fast-paced, evolving technology environments.

Technologies

SAST, SCA, DAST, API security, secrets detection, threat modeling, GitHub, Azure DevOps, Jenkins, cloud-native platforms, AI-enabled Application Security, generative AI, AI-assisted development tools, Model Context Protocol (MCP), AI agents, agentic architectures, tool calling, retrieval-augmented generation, AWS, Azure, GCP, Python, PowerShell.

Preferred Qualifications

• Knowledge of Model Context Protocol (MCP), AI agents, agentic architectures, tool calling, retrieval-augmented generation, and secure integration of AI with enterprise platforms.
• Experience with cloud application security across multi-cloud environments such as AWS, Azure, and GCP, with understanding of cloud-native security controls.
• Strong automation capabilities and experience improving security operations at enterprise scale using scripting languages such as Python, PowerShell, or similar.
• Experience with software supply chain security initiatives, including dependency governance, artifact management, provenance validation, and trusted package consumption practices.

Benefits

• Health care coverage designed for the mind and body
• Generous time off
• Access to resources to grow your career and learn valuable new skills
• Competitive pay, retirement planning, continuing education program with a company-matched student loan contribution, and financial wellness programs
• Family friendly perks for partners and little ones
• Retail discounts and referral incentive awards
• For more information on benefits by country: https://spgbenefits.com/benefit-summaries

Company Mission and Values

OUR MISSION: Advancing Essential Intelligence.

OUR VALUES: Integrity, Discovery, Partnership

Recruitment Fraud Alert

If you receive an email from a spglobalind.com domain or any other regionally based domains, it is a scam and should be reported to [email protected]. S&P Global never requires any candidate to pay money for job applications, interviews, offer letters, “pre-employment training” or for equipment or delivery of equipment.

Accommodation During the Application Process

If you need an accommodation during the application process due to a disability, send an email to: [email protected]

US Candidates Only

Know Your Rights: Workplace discrimination is illegal