# Application Security Lead **Company**: S&P Global **Location**: Hyderabad, Telangana **Experience**: senior **Job type**: full-time **Category**: Security **Industry**: Technology **Apply**: https://spgi.wd5.myworkdayjobs.com/en-US/SPGI_Careers/job/Hyderabad-Telangana/Senior-Analyst-Application-Security_332566-1?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply **Canonical**: https://yubhub.co/jobs/job_00fe5867-f4c ## Description The SGA Application Security team operates as a strategic security partner, combining Application Security, DevSecOps, Exposure Management, and AI Security capabilities to proactively reduce risk while enabling innovation. **Responsibilities and Impact:** - Lead complex application security assessments across multiple testing methodologies, including SAST, SCA, DAST, API security, secrets detection, and threat modeling to identify and mitigate security vulnerabilities. - Drive integration of security controls into developer workflows across GitHub, Azure DevOps, Jenkins, and cloud-native platforms, implementing risk-based quality gates that enhance secure coding practices. - Perform comprehensive threat modeling and security design reviews for new applications, APIs, and cloud services, providing strategic guidance on secure architecture decisions. - Design and implement AI-enabled Application Security capabilities, including custom tools, agents, and automations that improve security testing, triage, and remediation while meeting enterprise governance standards. - Partner with cross-functional teams, including engineering, product, cloud, and risk stakeholders, to resolve systemic application risks and establish scalable security controls across the SDLC. - Provide technical leadership and mentoring to security analysts and engineering partners while contributing to enterprise standards, procedures, and audit-ready documentation. **What We're Looking For:** - Bachelor's degree in Cybersecurity, Computer Science, Engineering, or related field, or equivalent professional experience. - 6+ years of experience in Application Security, DevSecOps, secure software engineering, or penetration testing with hands-on technical expertise. - Strong knowledge of application security testing methodologies, including SAST, SCA, DAST, threat modeling, secure design principles, and CI/CD security practices. - Experience integrating security controls into development platforms such as GitHub, Azure DevOps, Jenkins, and cloud-native delivery environments. - Practical experience using generative AI and AI-assisted development tools to build custom security tools, scripts, integrations, or automations. - Ability to lead technical engagements, communicate complex security risks to senior stakeholders, and drive remediation across distributed engineering teams. - Strong analytical and problem-solving abilities with attention to detail. - Excellent communication and presentation skills for technical and non-technical audiences. - Leadership and mentoring capabilities with collaborative team approach. - Adaptability to work in fast-paced, evolving technology environments. **Benefits:** - Health & Wellness: Health care coverage designed for the mind and body. - Flexible Downtime: Generous time off helps keep you energized for your time on. - Continuous Learning: Access a wealth of resources to grow your career and learn valuable new skills. - Invest in Your Future: Secure your financial future through competitive pay, retirement planning, a continuing education program with a company-matched student loan contribution, and financial wellness programs. - Family Friendly Perks: It's not just about you. S&P Global has perks for your partners and little ones, too, with some best-in-class benefits for families. - Beyond the Basics: From retail discounts to referral incentive awards,small perks can make a big difference. ## Skills ### Required - Application Security - DevSecOps - SAST - SCA - DAST - API security - threat modeling - secure design principles - CI/CD security practices - GitHub - Azure DevOps - Jenkins - cloud-native platforms - generative AI - AI-assisted development tools ### Nice to have - Model Context Protocol (MCP) - AI agents - agentic architectures - tool calling - retrieval-augmented generation - secure integration of AI with enterprise platforms - cloud application security - multi-cloud environments - AWS - Azure - GCP - cloud-native security controls - automation capabilities - scripting languages - Python - PowerShell - software supply chain security initiatives - dependency governance - artifact management - provenance validation - trusted package consumption practices --- Source: [Apply at spgi.wd5.myworkdayjobs.com](https://spgi.wd5.myworkdayjobs.com/en-US/SPGI_Careers/job/Hyderabad-Telangana/Senior-Analyst-Application-Security_332566-1?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply)