Description
As Lead DevSecOps Engineer, you will set the direction for how S&P Global secures the way its software is built and delivered.
You will own the SDLC security strategy, policy framework and roadmap, lead a team of DevSecOps engineers, and turn policy into automated, sustainable controls across the developer toolchain.
Working closely with platform and SRE leaders, divisional DevOps/TechOps teams, InfoSec and Business Information Security Officers (BISOs), you will raise the organisation’s security posture and audit readiness – without slowing engineers down.
Responsibilities
Strategy and Leadership
- Own the SDLC security strategy, policy framework and roadmap, aligned with InfoSec and audit requirements.
- Lead, mentor and grow a team of DevSecOps engineers, and drive delivery of toolchain hardening programmes.
- Report on security posture, risk and remediation progress to senior stakeholders.
- Partner with platform, SRE and engineering leaders to ensure controls are automated, sustainable and widely adopted.
Security Engineering and Tooling
- Define and implement baseline security policies and automated guardrails across source control and CI/CD environments.
- Integrate, manage and tune code quality and application security tools, including SonarQube, Checkmarx and Wiz, within developer workflows.
- Harden build infrastructure and software supply chain controls, including artifact management with JFrog Artifactory/Xray.
- Provision, secure and optimise AWS services supporting the developer platform, including EC2, ECS/EKS, Lambda, S3, IAM and CloudFormation/CDK.
- Lead security architecture reviews and incident response for toolchain security events.
Governance, Risk and Compliance
- Govern application security and supply chain tooling, including exception management and remediation service-level agreements (SLAs).
- Triage security findings, prioritise vulnerabilities by risk and track remediation to closure.
- Establish governance for credentials, secrets and non-human identities across the developer toolchain.
- Define governance for AI-assisted development tools and developer endpoint security.
- Monitor sensitive configuration changes, implement alerting and own audit readiness and compliance evidence.
What We’re Looking For
Experience and Leadership
- 8+ years of experience in DevSecOps, application security or security engineering, including leading teams or programmes.
- Proven ability to define security policy and standards, translate them into technical enforcement, and drive adoption across a large organisation.
- Strong knowledge of compliance frameworks (e.g., SOX, SOC 2, ISO 27001) and identity governance.
- Excellent communication and stakeholder management skills, with the ability to influence engineering teams and senior leaders.
Technical Skills
- Deep expertise in designing, automating and securing enterprise-scale CI/CD pipelines, including common pipeline and source control threats.
- Hands-on knowledge of GitHub Enterprise Cloud, GitHub Actions, runners, rulesets and policies.
- Strong understanding of repository lifecycle management and Git practices, including Conventional Commits, semantic versioning, trunk-based development/GitFlow and pull request workflows.
- Hands-on experience with static application security testing (SAST), software composition analysis (SCA), secrets scanning and cloud security tooling.
- Knowledge of identity and access management, including single sign-on (SSO), role-based access control (RBAC) and least privilege.
- Proficiency with infrastructure as code (Terraform, CloudFormation or CDK) and familiarity with configuration management tools.
- Experience with AWS compute, networking, storage, IAM and container orchestration (ECS/EKS), including AWS security best practices.
- Strong scripting and automation skills in Python or Bash; familiarity with TypeScript/Node.js.
Benefits
- Health & Wellness: Health care coverage designed for the mind and body.
- Flexible Downtime: Generous time off helps keep you energized for your time on.
- Continuous Learning: Access a wealth of resources to grow your career and learn valuable new skills.
- Invest in Your Future: Secure your financial future through competitive pay, retirement planning, a continuing education program with a company-matched student loan contribution, and financial wellness programs.
- Family Friendly Perks: It’s not just about you. S&P Global has perks for your partners and little ones, too, with some best-in class benefits for families.