Director, Cyber Governance and Compliance

S&P Global•Charlottesville, VA

1d•$150,000 - $205,000

About The Position

The Director, Cyber Governance and Compliance serves on the Market Intelligence Cyber Governance and Compliance team, which bridges security requirements and business objectives. The team works across technology, legal, and sales functions to translate complex and evolving regulatory requirements into practical guidance for externally facing products and services, enabling commercial success while supporting robust security practices. In this role, you will lead negotiations on security and compliance terms in client agreements and advise Sales and Legal teams. You will make risk-based decisions about proposed security commitments, evaluate compensating controls and potential roadmap investments, and communicate your rationale to stakeholders. You will partner with Legal to assess whether the organization can meet negotiated commitments, interpret regulatory requirements, and guide development and technical teams. You will also identify gaps between client demands and organizational capabilities and maintain a repository of approved security positions, standard language, and control framework mappings. The position requires 12 or more years of progressive experience in relevant security, governance, risk, compliance, assurance, AI, or third-party risk work; expert knowledge of major compliance frameworks and security controls; and strong communication and negotiation skills. A bachelor's degree in a related field or equivalent professional experience is required. The role is limited to people with indefinite authorization to work in the United States. The anticipated US base salary range is $150,000 to $205,000, and the role is eligible for an annual incentive plan and S&P Global benefits.

Requirements

12 or more years of progressive experience in security governance, risk management and compliance (GRC), security assurance, artificial intelligence, or third-party risk management, including expertise in regulatory interpretation and security contract negotiation.
Working knowledge of financial services and enterprise regulatory environments, including GDPR, DORA, NIS2, and the EU AI Act.
Demonstrated ability to make independent, defensible risk decisions in high-pressure deal environments with measurable business impact.
Experience developing and implementing scalable processes, playbooks, and frameworks for security assurance functions in enterprise environments.
Comprehensive technical knowledge of infrastructure and application controls, modern cloud security controls, cloud platforms such as AWS, Azure, or GCP, containerization technologies such as Docker, Kubernetes, or OpenShift, identity and access management, encryption protocols, and security monitoring solutions.
Expert proficiency in compliance frameworks including COBIT, SOC 2, ISO 27001, NIST Cybersecurity Framework, NIST 800-53, and ISO 42001, with the ability to map contractual requirements to specific security controls.
Exceptional written and verbal communication skills, including the ability to engage legal counsel, negotiate complex terms, and present technical concepts to executive leadership.
Bachelor's degree in Computer Science, Information Security, Risk Management, Business Administration, or a related field, or equivalent professional experience.
Indefinite right to work in the United States.

Nice To Haves

Industry certifications such as CISSP, CISM, CISA, CCSP, CIPP, or CRISC.
Hands-on experience with contract management platforms, security questionnaire automation tools such as OneTrust or MetricStream, or similar tools, and GRC technology solutions.

Responsibilities

Lead negotiations on security and compliance terms in client agreements, serving as the primary technical advisor to Sales and Legal while maintaining strategic customer relationships.
Evaluate proposed security commitments using risk-based decision-making, including analysis of compensating controls and potential roadmap investments, and communicate the rationale to stakeholders.
Partner with Legal as a technical subject matter expert to ensure the organization can deliver negotiated security commitments and provide potential contractual language.
Interpret complex regulatory requirements, assess their scope and the organization's compliance capabilities, and develop guidance for development and technical teams.
Identify systemic gaps between client security demands and organizational capabilities through cross-functional partnerships and strategic roadmap advocacy.
Establish and maintain a knowledge repository of pre-approved security positions, standardized language, and control framework mappings to improve consistency and efficiency.