Director, Cyber Governance and Compliance

OSTTRA•Princeton, NY

About The Position

The Director, Cyber Governance and Compliance will work on S&P Global Market Intelligence’s Cyber Governance and Compliance team, which connects security requirements with business objectives. The team operates across technology, legal, and sales functions, translating complex and evolving regulations into actionable guidance for externally facing products and services. It emphasizes analytical rigor, collaboration, and risk-based decisions that protect the organization and its clients. The role leads security and compliance contract negotiations with clients and advises Sales and Legal teams on security commitments. It evaluates proposed commitments using risk-based analysis, including compensating controls and potential roadmap investments, and communicates the rationale to stakeholders. The position also interprets regulatory requirements, assesses compliance capabilities, advises development and technical teams, and works across functions to address gaps between client demands and organizational capabilities. It maintains a repository of approved security positions, standard language, and control-framework mappings. The position requires extensive experience in security governance, risk management and compliance, security assurance, artificial intelligence, or third-party risk management; knowledge of financial services and enterprise regulatory environments; and technical expertise in infrastructure, applications, cloud security, and compliance frameworks. A bachelor’s degree in a relevant field or equivalent professional experience is required. The role is limited to people with indefinite authorization to work in the United States.

Requirements

12+ years of progressive experience in security governance, risk management and compliance (GRC), security assurance, artificial intelligence, or third-party risk management, including expertise in regulatory interpretation and security contract negotiation.
Working knowledge of financial services and enterprise regulatory environments, including GDPR, DORA, NIS2, and the EU AI Act.
Track record of making independent, defensible risk decisions in high-pressure deal environments with measurable business impact.
Experience developing and implementing scalable processes, playbooks, and frameworks for enterprise security assurance functions.
Comprehensive technical knowledge of infrastructure and application controls; cloud security controls and platforms such as AWS, Azure, or GCP; containerization technologies such as Docker, Kubernetes, or OpenShift; identity and access management; encryption protocols; and security monitoring solutions.
Expert-level proficiency in compliance frameworks including COBIT, SOC 2, ISO 27001, NIST Cybersecurity Framework, NIST 800-53, and ISO 42001, with the ability to map contractual requirements to specific security controls.
Exceptional written and verbal communication skills, including the ability to engage legal counsel, negotiate complex terms, and present technical concepts to executive leadership.
Bachelor’s degree in Computer Science, Information Security, Risk Management, Business Administration, or a related field, or equivalent professional experience.
Indefinite right to work in the United States.

Nice To Haves

Industry certifications such as CISSP, CISM, CISA, CCSP, CIPP, or CRISC.
Hands-on experience with contract management platforms, security questionnaire automation tools such as OneTrust or MetricStream, and GRC technology solutions.

Responsibilities

Lead negotiations of security and compliance terms in client agreements, serving as the primary technical advisor to Sales and Legal while maintaining strategic customer relationships.
Evaluate proposed security commitments through risk-based decision-making, including analysis of compensating controls and potential roadmap investments, and communicate the rationale to stakeholders.
Partner with Legal as the technical subject matter expert to ensure the organization can deliver on negotiated security commitments and provide potential contractual language.
Interpret complex regulatory requirements, assess their scope and the organization’s compliance capabilities, and develop guidance for development and technical teams.
Identify systemic gaps between client security demands and organizational capabilities through cross-functional partnerships and strategic roadmap advocacy.
Establish and maintain a knowledge repository of pre-approved security positions, standardized language, and control-framework mappings.