Lead DevSecOps Engineer
Core
Lead the SDLC security strategy, policy framework, and roadmap for S&P Global's enterprise developer platform and toolchain, ensuring automated security controls without slowing engineering velocity.
Role type
Senior IC Lead DevSecOps Engineer (Enterprise Platform)
Builds
Automated security controls, policies, and governance for the developer toolchain (CI/CD, source control, cloud infrastructure, supply chain).
Domain
Enterprise Software Development, DevSecOps, Cloud Security, Compliance
Required skills
SDLC security strategy, team leadership, CI/CD pipeline security, SAST/SCA tooling, cloud security (AWS), infrastructure as code, scripting (Python/Bash), identity governance, compliance frameworks (SOX, SOC 2, ISO 27001), software supply chain security.
Preferred skills
AI-assisted development governance, open-source IDP contributions, compliance as code (OPA/Sentinel), SLSA/SBOM practices, security certifications (CISSP, CISM, AWS).
Technologies
GitHub Enterprise, GitHub Actions, Checkmarx, SonarQube, Wiz, JFrog Artifactory, HashiCorp Vault, Okta, Splunk, Terraform, AWS (EC2, ECS/EKS, Lambda, S3, IAM), Python, Bash.
Responsibilities
Define and implement baseline security policies and automated guardrails across source control and CI/CD; integrate and tune code quality and application security tools; harden build infrastructure and software supply chain controls; lead security architecture reviews and incident response; govern application security tooling and exception management; monitor sensitive configuration changes and own audit readiness.
Seniority
Senior, hands-on IC with team leadership
