S&P Global is seeking an Application Security Lead to drive complex application security programs across the enterprise. This role provides technical leadership, integrates security into developer workflows, and designs AI-enabled Application Security capabilities aligned with enterprise governance.
Location
Princeton, NJ (onsite)
Compensation
USD 120,000 - 150,000 per year.
(US candidates) S&P Global states that the anticipated base salary range for this position is $120,000 to $150,000. Final base salary will be based on geographic location, experience level, skill set, training, licenses and certifications.
Key Responsibilities
- Lead complex application security assessments using multiple testing methodologies, including SAST, SCA, DAST, API security, secrets detection, and threat modeling to identify and mitigate vulnerabilities.
- Drive integration of security controls into developer workflows across GitHub, Azure DevOps, Jenkins, and cloud-native platforms, implementing risk-based quality gates to strengthen secure coding practices.
- Conduct comprehensive threat modeling and security design reviews for new applications, APIs, and cloud services, providing strategic guidance for secure architecture decisions.
- Design and implement AI-enabled Application Security capabilities, including custom tools, agents, and automations that improve security testing, triage, and remediation while meeting enterprise governance standards.
- Collaborate with cross-functional partners across engineering, product, cloud, and risk to address systemic application risks and establish scalable security controls across the SDLC.
- Provide technical leadership and mentoring to security analysts and engineering partners, and contribute to enterprise standards, procedures, and audit-ready documentation.
Required Qualifications
- Bachelor's degree in Cybersecurity, Computer Science, Engineering, or related field, or equivalent professional experience.
- 6+ years of experience in Application Security, DevSecOps, secure software engineering, or penetration testing with hands-on technical expertise.
- Strong knowledge of application security testing methodologies, including SAST, SCA, DAST, threat modeling, secure design principles, and CI/CD security practices.
- Experience integrating security controls into development platforms such as GitHub, Azure DevOps, Jenkins, and cloud-native delivery environments.
- Practical experience using generative AI and AI-assisted development tools to build custom security tools, scripts, integrations, or automations.
- Ability to lead technical engagements, communicate complex security risks to senior stakeholders, and drive remediation across distributed engineering teams.
- Strong analytical and problem-solving skills with attention to detail.
- Excellent communication and presentation skills for technical and non-technical audiences.
- Leadership and mentoring capabilities, with a collaborative team approach.
- Adaptability to work in fast-paced, evolving technology environments.
Technologies
SAST, SCA, DAST, API security, secrets detection, threat modeling, GitHub, Azure DevOps, Jenkins, cloud-native platforms, AI-enabled Application Security, generative AI, AI-assisted development tools, Model Context Protocol (MCP), AI agents, agentic architectures, tool calling, retrieval-augmented generation, AWS, Azure, GCP, Python, PowerShell.
Preferred Qualifications
- Knowledge of Model Context Protocol (MCP), AI agents, agentic architectures, tool calling, retrieval-augmented generation, and secure integration of AI with enterprise platforms.
- Experience with cloud application security across multi-cloud environments such as AWS, Azure, and GCP, with understanding of cloud-native security controls.
- Strong automation capabilities and experience improving security operations at enterprise scale using scripting languages such as Python, PowerShell, or similar.
- Experience with software supply chain security initiatives, including dependency governance, artifact management, provenance validation, and trusted package consumption practices.
Benefits
- Health care coverage designed for the mind and body
- Generous time off
- Access to resources to grow your career and learn valuable new skills
- Competitive pay, retirement planning, continuing education program with a company-matched student loan contribution, and financial wellness programs
- Family friendly perks for partners and little ones
- Retail discounts and referral incentive awards
- For more information on benefits by country: https://spgbenefits.com/benefit-summaries
Company Mission and Values
OUR MISSION: Advancing Essential Intelligence.
OUR VALUES: Integrity, Discovery, Partnership
Recruitment Fraud Alert
If you receive an email from a spglobalind.com domain or any other regionally based domains, it is a scam and should be reported to reportfraud@spglobal.com. S&P Global never requires any candidate to pay money for job applications, interviews, offer letters, “pre-employment training” or for equipment or delivery of equipment.
Accommodation During the Application Process
If you need an accommodation during the application process due to a disability, send an email to: EEO.Compliance@spglobal.com
US Candidates Only
Know Your Rights: Workplace discrimination is illegal
