Associate Director - Application Security

S&P Global•New York, NY

About The Position

The SGA Application Security team is a strategic security partner combining Application Security, DevSecOps, Exposure Management, and AI Security capabilities to reduce risk while enabling innovation. The team emphasizes automation-first approaches, developer partnership, and continuous learning, and works on enterprise-wide security transformation initiatives, AI-powered security tools, and challenges affecting global engineering teams. The Associate Director leads complex application security assessments and integrates security controls into developer workflows. The role provides security design guidance, develops AI-enabled application security tools and automations, partners with engineering and other stakeholders to address systemic risks, and provides technical leadership and mentorship.

Requirements

Bachelor's degree in Cybersecurity, Computer Science, or Engineering.
At least 6 years of experience in Application Security, DevSecOps, or secure software.
Proficiency in application security testing methodologies, including SAST, SCA, DAST, threat modeling, and CI/CD security integration.
Experience integrating security controls into GitHub, Azure DevOps, Jenkins, or cloud-native delivery environments.
Experience using generative AI and AI-assisted development tools to build custom security tooling, scripts, integrations, or automations.

Nice To Haves

Experience with Model Context Protocol (MCP), AI agents, agentic architectures, tool calling, and retrieval-augmented generation for secure enterprise AI integration.
Experience with cloud application security across AWS, Azure, and GCP, including cloud-native security controls in multi-cloud environments.
Proficiency in Python, PowerShell, or equivalent scripting languages to automate and improve security operations at enterprise scale.
Experience with software supply chain security initiatives, including dependency governance, artifact management, provenance validation, and trusted package consumption.
Ability to communicate complex security risks to senior stakeholders and drive remediation across distributed engineering teams.
Experience providing technical mentorship within security or engineering teams.

Responsibilities

Lead application security assessments using SAST, SCA, DAST, API security, secrets detection, and threat modeling to identify and mitigate vulnerabilities.
Integrate security controls into developer workflows across GitHub, Azure DevOps, Jenkins, and cloud-native platforms, including risk-based quality gates.
Perform threat modeling and security design reviews for applications, APIs, and cloud services, and advise on secure architecture decisions.
Design and implement AI-enabled application security tools, agents, and automations for security testing, triage, and remediation in accordance with enterprise governance standards.
Partner with engineering, product, cloud, and risk stakeholders to resolve systemic application risks and establish scalable SDLC security controls.
Provide technical leadership and mentorship to security analysts and engineering partners.
Contribute to enterprise standards, procedures, and audit-ready documentation.