Lead DevSecOps Engineer

About the Role: Grade Level (for internal use): 11Role: Lead DevSecOps Engineer – Enterprise Developer Platform and Toolchain The Team  The Enterprise Developer Platform & Toolchain team owns the platforms, tools and capabilities that support software engineers across S&P Global. Our remit spans DevOps, DevSecOps, FinOps, Platform Engineering, Site Reliability Engineering (SRE) and Developer Experience (DevEx). We partner with divisional DevOps/TechOps teams and Information Security (InfoSec) to establish consistent controls and governance across the software development lifecycle (SDLC). As a globally distributed team, we build services, policies and automated controls that secure the developer toolchain while keeping our platforms simple, consistent and engineer friendly.  The Impact  As Lead DevSecOps Engineer, you will set the direction for how S&P Global secures the way its software is built and delivered. You will own the SDLC security strategy, policy framework and roadmap, lead a team of DevSecOps engineers, and turn policy into automated, sustainable controls across the developer toolchain. Working closely with platform and SRE leaders, divisional DevOps/TechOps teams, InfoSec and Business Information Security Officers (BISOs), you will raise the organisation’s security posture and audit readiness – without slowing engineers down.  What’s in It for You  Enterprise-scale ownership: Lead end-to-end delivery of security controls across GitHub Enterprise, GitHub Actions, OIDC, Checkmarx, SonarQube, Wiz, Artifactory/Xray, Vault, Okta/SailPoint and Splunk.  Emerging technology: Shape governance for AI-assisted development (Copilot controls, MCP, agent guardrails) and software supply chain security (SBOM, signing, SLSA).  Visibility and influence: Engage directly with senior leaders and auditors on high-profile initiatives tied to company strategy, across frameworks including SOX, SOC 2, ISO 27001 and NIST SSDF.  Growth: Build and grow a team, and access innovation projects, training, knowledge sharing and support for security certifications such as CISSP, CISM and CSSLP.  Responsibilities  Strategy and Leadership  Own the SDLC security strategy, policy framework and roadmap, aligned with InfoSec and audit requirements.  Lead, mentor and grow a team of DevSecOps engineers, and drive delivery of toolchain hardening programmes.  Report on security posture, risk and remediation progress to senior stakeholders.  Partner with platform, SRE and engineering leaders to ensure controls are automated, sustainable and widely adopted.  Security Engineering and Tooling  Define and implement baseline security policies and automated guardrails across source control and CI/CD environments.  Integrate, manage and tune code quality and application security tools, including SonarQube, Checkmarx and Wiz, within developer workflows.  Harden build infrastructure and software supply chain controls, including artifact management with JFrog Artifactory/Xray.