Sr. Director, Risk and Compliance

S&P Global•Princeton, NY

About The Position

The Market Intelligence Cyber Risk and Compliance team acts as a strategic bridge between security requirements and business objectives. Working across technology, legal, and sales, the team translates complex and evolving regulatory requirements into guidance for externally facing products and services, using analytical rigor, collaborative problem-solving, and risk-based decisions to protect the organization and its clients. The Sr. Director leads security and compliance negotiations for client agreements and advises Sales and Legal on technical matters while maintaining customer relationships. The role evaluates proposed commitments and compensating controls, communicates defensible risk decisions, interprets regulatory requirements, and helps technical teams meet applicable obligations. It also identifies systemic gaps between client requirements and organizational capabilities, advocates for roadmap improvements, and maintains a repository of approved security positions, language, and control mappings.

Requirements

15+ years of total progressive experience in security governance, risk management and compliance (GRC), security assurance, artificial intelligence, or third-party risk management, with expertise in regulatory interpretation and security contract negotiation.
Working knowledge of financial services and enterprise regulatory environments, including GDPR, DORA, NIS2, and the EU AI Act.
Demonstrated ability to make independent, defensible risk decisions in high-pressure deal environments with measurable business impact.
Experience developing and implementing scalable processes, playbooks, and frameworks for security assurance functions in enterprise environments.
Comprehensive technical knowledge of infrastructure and application controls; cloud security controls and platforms such as AWS, Azure, or GCP; containerization technologies such as Docker, Kubernetes, or OpenShift; identity and access management; encryption protocols; and security monitoring solutions.
Expert-level proficiency in compliance frameworks including COBIT, SOC 2, ISO 27001, NIST Cybersecurity Framework, NIST 800-53, and ISO 42001, with ability to map contractual requirements to security controls.
Exceptional written and verbal communication skills, including ability to engage with legal counsel, negotiate complex terms, and present technical concepts to executive leadership.
Bachelor’s degree in Computer Science, Information Security, Risk Management, Business Administration, or a related field, or equivalent professional experience.
Indefinite right to work in the United States.

Nice To Haves

Industry certifications such as CISSP, CISM, CISA, CCSP, CIPP, or CRISC.
Hands-on experience with contract management platforms, security questionnaire automation tools such as OneTrust or MetricStream, or similar tools, and GRC technology solutions.

Responsibilities

Lead negotiations of security and compliance terms in client agreements, acting as the primary technical advisor to Sales and Legal while maintaining strategic customer relationships.
Evaluate proposed security commitments using risk-based decision-making, including analysis of compensating controls and potential roadmap investments, and clearly communicate the rationale to stakeholders.
Partner with Legal as the technical subject matter expert to ensure the organization can deliver on negotiated security commitments and provide potential contractual language.
Analyze and interpret regulatory requirements, assess their scope and the organization’s compliance capabilities, and develop guidance for development and technical teams.
Identify systemic gaps between client security demands and organizational capabilities through cross-functional partnerships and strategic roadmap advocacy.
Establish and maintain a knowledge repository of pre-approved security positions, standardized language, and control framework mappings.