Associate Director, Application Security

S&P Global•Boulder, CO

About The Position

The Associate Director, Application Security will lead execution of S&P Global’s enterprise Application Security strategy and roadmap, advancing secure software development, platform maturity, and measurable risk reduction across global engineering teams. The role operates within the SGA Application Security team, a strategic security partner combining Application Security, DevSecOps, Exposure Management, and AI Security. The team emphasizes automation, developer partnership, and continuous learning. This senior leader oversees application security testing and enterprise platforms, establishes standards and governance, and drives software supply chain security. The position also leads a global team, manages vendor relationships, and partners with technology, product, and business leaders to deliver security transformation. A key focus is guiding the adoption of generative AI and agentic technologies in Application Security, including governance for custom AI-enabled tools, agents, and automations. The anticipated US base salary range is $130,000 to $160,000. Final base salary depends on geographic location, experience, skills, training, licenses, and certifications.

Requirements

Demonstrated leadership of enterprise Application Security, DevSecOps, or Product Security programs in complex environments, with a proven track record of driving transformation.
Deep knowledge of application testing methodologies, threat modeling, secure architecture, CI/CD security, cloud-native security, and software supply chain risk management.
Experience defining enterprise standards, operating models, remediation governance, exception processes, and measurable KPIs and KRIs.
Strong stakeholder management and executive communication skills, including the ability to translate technical risk into business impact and strategic decisions.
Experience leading teams, mentoring technical professionals, managing vendor relationships, and driving cross-functional initiatives across global organizations.
Executive-level communication and presentation capabilities.
Strategic thinking and ability to balance technical depth with business priorities.
Strong leadership and team development skills with a global mindset.
Proven ability to influence and drive change across complex organizational structures.

Nice To Haves

Knowledge of generative AI, large language models, AI-assisted software development, and practical applications of AI to cybersecurity and DevSecOps use cases.
Understanding of Model Context Protocol (MCP), AI agents, agentic architectures, tool calling, retrieval-augmented generation, AI security risks, and governance frameworks for AI integration.
Experience with multi-cloud security architectures and controls across AWS, Azure, and GCP, and understanding of cloud-native delivery environments.
Track record in vendor management, contract negotiation, platform roadmap development, and strategic technology partnerships in enterprise security environments.

Responsibilities

Lead execution of the enterprise Application Security strategy and roadmap, driving secure SDLC transformation, platform maturity, and measurable risk reduction across global engineering teams.
Own and oversee application security testing capabilities, including SAST, SCA, DAST, API security, threat modeling, and penetration testing; establish enterprise standards and governance frameworks.
Drive strategic adoption and operational effectiveness of enterprise AppSec and ASPM platforms, and provide executive-ready reporting on coverage, vulnerability trends, and remediation performance.
Lead software supply chain security initiatives covering dependency governance, artifact curation, provenance validation, and trusted build practices; manage incident response for zero-day exposures.
Build, mentor, and develop a high-performing global team; manage strategic vendor relationships and drive cross-functional transformation with technology, product, and business leaders.
Lead adoption of generative AI and agentic technologies within Application Security, establishing governance for custom AI-enabled tools, agents, and automations while ensuring appropriate security and oversight.