Director, Cyber Governance and Compliance

S&P Global•Charlottesville, VA

About The Position

The Director, Cyber Governance and Compliance serves on S&P Global Market Intelligence’s Cyber Governance and Compliance team, which bridges security requirements and business objectives. The team works across technology, legal, and sales functions to translate evolving regulatory requirements into actionable guidance for externally facing products and services. The role leads security and compliance negotiations in client agreements, makes risk-based decisions about proposed security commitments, and advises Legal, Sales, technical teams, and executives. It also develops consistent processes, guidance, and resources to support security assurance and organizational compliance capabilities.

Requirements

12 or more years of progressive experience in security governance, risk management and compliance (GRC), security assurance, artificial intelligence, or third-party risk management, including expertise in regulatory interpretation and security contract negotiation.
Working knowledge of financial services and enterprise regulatory environments, including GDPR, DORA, NIS2, the EU AI Act, and related compliance regimes.
Demonstrated ability to make independent, defensible risk decisions in high-pressure deal environments with measurable business impact.
Experience developing and implementing scalable processes, playbooks, and frameworks for security assurance functions in enterprise environments.
Comprehensive technical knowledge of infrastructure and application controls; modern cloud security controls and platforms such as AWS, Azure, or GCP; containerization technologies such as Docker, Kubernetes, or OpenShift; identity and access management; encryption protocols; and security monitoring solutions.
Expert-level proficiency in compliance frameworks including COBIT, SOC 2, ISO 27001, NIST Cybersecurity Framework, NIST 800-53, and ISO 42001, with the ability to map contractual requirements to specific security controls.
Exceptional written and verbal communication skills, including the ability to engage legal counsel, negotiate complex terms, and present technical concepts to executive leadership.
Bachelor’s degree in Computer Science, Information Security, Risk Management, Business Administration, or a related field, or equivalent professional experience.
Must have an indefinite right to work in the United States.

Nice To Haves

Industry certifications such as CISSP, CISM, CISA, CCSP, CIPP, or CRISC.
Hands-on experience with contract management platforms, security questionnaire automation tools such as OneTrust or MetricStream, and GRC technology solutions.

Responsibilities

Lead negotiations of security and compliance terms in client agreements, serving as the primary technical advisor to Sales and Legal while maintaining strategic customer relationships.
Evaluate proposed security commitments using risk-based analysis, including compensating controls and potential roadmap investments, and clearly communicate the rationale to stakeholders.
Partner with Legal as a technical subject matter expert to ensure the organization can deliver on negotiated commitments and provide potential contractual language.
Analyze and interpret regulatory requirements, assess their scope and the organization’s compliance capabilities, and develop guidance for development and technical teams.
Identify systemic gaps between client security demands and organizational capabilities through cross-functional partnerships and strategic roadmap advocacy.
Establish and maintain a knowledge repository of pre-approved security positions, standardized language, and control-framework mappings to promote consistency and efficiency.