Director, Security Architect

• The Team:

  The SPGI Market Intelligence (MI) InfoSec team works to increase value in our products through strong security posture.  When we can show our customers their information is protected with us, they are more apt to bring new opportunities.  Additionally, our work to reduce risk contributes to the value returned to our customers and shareholders.  We engage closely with product teams to deliver security practices, capabilities, and advisory services to continually improve and ensure security is incorporated throughout the product lifecycle.

  Responsibilities and Impact:

  The security resource will be aligned to an MI Tech business segment to collaborate in-depth with developers, SREs, DBAs, and other personnel to both instill a security mindset and support security improvement efforts.  The individual will use their experience strategically and tactically in supporting products teams to find the most efficient and effective methods to close vulnerabilities, implement security capabilities and respond to issues or alerts.
• Product engagement
• Identify and prioritize critical business functions in collaboration with organizational stakeholders.
• Engage with business units to understand their security requirements and align security capabilities accordingly.
• Determine the protection needs (i.e., security controls) for the information systems, environments, and networks and document appropriately.
• Document and/or review security standards, architectures and blueprints for adoption by product teams to improve protection, visibility and transparency.
• Collaborate with stakeholders to implement security standards and procedures.
• Security Assessments
• Perform security reviews, identify gaps in security architecture and controls to develop security risk management plans.
• Support and expand ACF process to mature security oversight.
• Conduct security assessments of third-party applications and vendors as provided by the division or centralized teams.
• Support the M&A processes with security assessments, third-party engagements and integration or divestiture oversight.
• Education and enablement
• Provide technical guidance and support to the security and product teams in incident response, control adoption, and threat mitigation.
• Facilitate educational opportunities within the division to increase security awareness, secure coding practices and secure architecture and design.
• Application Security
• Design and implement secure coding practices and guidelines for application development teams.
• Collaborate with development teams to integrate security controls into the software development lifecycle.

What Were Looking For:

Requirements:

• Minimum of 8 years of experience in information security.
• Strong knowledge of security frameworks, such as ISO 27001 and NIST Cybersecurity Framework.
• Expertise in designing and implementing security controls, including cloud architectures, networks, monitoring, technical security policies.
• Stays up-to-date with the latest security technologies, approaches, and best practices.
• Experience with cloud security, network security, and secure coding practices.
• Excellent communication and interpersonal skills to collaborate with cross-functional teams.
• Relevant certifications such as CISSP, CISM, or CEH are preferred.