# Application Security Engineer

**Company**: S&P Global
**Location**: New York, NY
**Experience**: senior
**Job type**: full-time
**Salary**: $130,000 to $190,000
**Category**: Security
**Industry**: Finance

**Apply**: https://spgi.wd5.myworkdayjobs.com/en-US/SPGI_Careers/job/New-York-NY/Associate-Director---Application-Security_332723-2?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply
**Canonical**: https://yubhub.co/job/application-security-engineer-36cd54e9-c59/

## Description

The SGA Application Security team at S&P Global operates as a strategic security partner, combining Application Security, DevSecOps, Exposure Management, and AI Security capabilities to proactively reduce risk while enabling innovation.

**Responsibilities and Impact:** Lead complex application security assessments across multiple testing methodologies , including SAST, SCA, DAST, API security, secrets detection, and threat modeling , to identify and mitigate security vulnerabilities across the enterprise.

- Drive integration of security controls into developer workflows across GitHub, Azure DevOps, Jenkins, and cloud-native platforms, implementing risk-based quality gates that enhance secure coding practices.

- Perform comprehensive threat modeling and security design reviews for new applications, APIs, and cloud services, providing strategic guidance on secure architecture decisions.

- Design and implement AI-enabled Application Security capabilities , including custom tools, agents, and automations , that improve security testing, triage, and remediation while meeting enterprise governance standards.

- Partner with cross-functional teams including engineering, product, cloud, and risk stakeholders to resolve systemic application risks and establish scalable security controls across the SDLC.

- Provide technical leadership and mentoring to security analysts and engineering partners while contributing to enterprise standards, procedures, and audit-ready documentation.

**Requirements:**

- Bachelor's degree in Cybersecurity, Computer Science, or Engineering.

- 6+ years of experience in Application Security, DevSecOps, secure software.

- Demonstrated proficiency in application security testing methodologies including SAST, SCA, DAST, threat modeling, and CI/CD security integration.

- Demonstrated experience integrating security controls into GitHub, Azure DevOps, Jenkins, or cloud-native delivery environments.

- Demonstrated experience using generative AI and AI-assisted development tools to build custom security tooling, scripts, integrations, or automations.

**Preferred Qualifications:**

- Experience with Model Context Protocol (MCP), AI agents, agentic architectures, tool calling, and retrieval-augmented generation for secure enterprise AI integration.

- Experience with cloud application security across AWS, Azure, and GCP, with understanding of cloud-native security controls in multi-cloud environments.

- Proficiency in Python, PowerShell, or equivalent scripting languages to automate and improve security operations at enterprise scale.

- Experience with software supply chain security initiatives including dependency governance, artifact management, provenance validation, and trusted package consumption.

- Demonstrated ability to communicate complex security risks to senior stakeholders and drive remediation across distributed engineering teams.

- Experience providing technical mentorship within security or engineering teams.

**Compensation/Benefits Information:** The anticipated base salary range for this position is $130,000 to $190,000.

**Benefits:**

- Health & Wellness: Health care coverage designed for the mind and body.

- Flexible Downtime: Generous time off helps keep you energized for your time on.

- Continuous Learning: Access a wealth of resources to grow your career and learn valuable new skills.

- Invest in Your Future: Secure your financial future through competitive pay, retirement planning, a continuing education program with a company-matched student loan contribution, and financial wellness programs.

- Family Friendly Perks: It’s not just about you. S&P Global has perks for your partners and little ones, too, with some best-in-class benefits for families.

- Beyond the Basics: From retail discounts to referral incentive awards,small perks can make a big difference.

For more fresh new jobs, check out [yubhub.co](https://yubhub.co/).

## Skills

### Required
- SAST
- SCA
- DAST
- threat modeling
- CI/CD security integration
- GitHub
- Azure DevOps
- Jenkins
- AI-assisted development tools

### Nice to have
- Model Context Protocol (MCP)
- AI agents
- agentic architectures
- tool calling
- retrieval-augmented generation
- cloud application security
- AWS
- Azure
- GCP
- Python
- PowerShell
- software supply chain security initiatives

---

Source: [Apply at spgi.wd5.myworkdayjobs.com](https://spgi.wd5.myworkdayjobs.com/en-US/SPGI_Careers/job/New-York-NY/Associate-Director---Application-Security_332723-2?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply)