Lead DevSecOps Engineer
Core
Lead the SDLC security strategy, policy framework, and roadmap for S&P Global's enterprise developer platform and toolchain, securing the way software is built and delivered.
Role type
Senior IC Lead DevSecOps Engineer (Enterprise Platform)
Builds
Automated security controls, policies, and governance for the developer toolchain across CI/CD, cloud, and supply chain.
Domain
Enterprise Software Development, DevSecOps, Cloud Security, Supply Chain Security
Required skills
SDLC security strategy, team leadership, compliance frameworks (SOX, SOC 2, ISO 27001), CI/CD pipeline security, SAST/SCA, secrets management, AWS security, IaC (Terraform/CDK), Python/Bash scripting, identity governance (SSO/RBAC), incident response.
Preferred skills
AI-assisted development governance, software supply chain frameworks (SLSA, SBOM), compliance as code (OPA/Sentinel), security certifications (CISSP, CISM, AWS Security Specialty).
Technologies
GitHub Enterprise, GitHub Actions, Checkmarx, SonarQube, Wiz, JFrog Artifactory/Xray, HashiCorp Vault, Okta/SailPoint, Splunk, AWS (EC2, ECS/EKS, Lambda, S3, IAM), Terraform, CDK, Python, Bash.
Responsibilities
Define and implement baseline security policies and automated guardrails across source control and CI/CD; integrate and tune code quality and application security tools; harden build infrastructure and software supply chain controls; lead security architecture reviews and incident response; govern application security and supply chain tooling including exception management; triage security findings and track remediation; establish governance for credentials, secrets, and non-human identities; monitor sensitive configuration changes and own audit readiness.
Seniority
Senior, hands-on IC with leadership responsibilities
