Lead Security Engineer

About the role

Grade Level (for internal use): 12 The Team: Risk & Valuations Services (RVS) is part of S&P Global Market Intelligence, providing critical data, insights, and analytics to diverse customer segments across global financial markets. Our security engineering team operates as a highly collaborative, strategic unit where leaders combine deep offensive security expertise with business acumen to proactively identify and mitigate enterprise-scale risks across our expanding product portfolio. We value innovation, cross-divisional partnership, and the development of security capabilities that enable safe, authorized operations while driving S&P Global's mission to provide essential intelligence for confident decision-making. Responsibilities and Impact: Lead and oversee hands-on application and cloud penetration testing across assigned product portfolios, focusing on real-world exploitability and business risk while directing security engineering strategy for the region Plan, conduct, and supervise red team activities in accordance with approved scope, authorization, and Rules of Engagement defined by Corporate Offensive Security, ensuring team compliance and operational excellence Drive adoption of AI-assisted testing techniques (e.g., intelligent discovery, fuzzing, and analysis) across security teams to improve coverage, efficiency, and testing quality while establishing best practices Engage directly with senior product and engineering leadership to explain attack paths, prioritize findings, and facilitate timely, durable remediation while building organizational security capabilities Establish validation processes for remediation effectiveness, ensuring exploit paths are fully closed and do not regress, while mentoring team members on advanced security assessment techniques Transform findings and remediation efforts into educational programs and strategic guidance to drive stronger proactive security posture in alignment with Corporate and Divisional security teams, contributing to enterprise offensive security standards, playbooks, and threat scenarios while producing executive-level reports that communicate exploitability, impact, and remediation status to senior leadership