below marketmost similar roles pay hereabove market
This role pays less than
89%
of similar roles. Most pay
$157,437–$220,200
— the blue band above.
At the midpoint, this role pays about
$135k
versus about
$189k
for comparable roles.
Based on 240 similar postings.
Employer
About S&P Global
S&P Global delivers Essential Intelligence® that shapes decision making. We provide the world’s leading organizations with the right data, connected technologies and expertise they need to move ahead.
S&P Global currently has
39 open roles
on FindRole.
Listed pay typically runs
$145,245–$200,000
across 36 roles with salary data.
The Lead InfoSec Engineer, Vulnerability Management joins the Information Security team to lead the enterprise-wide vulnerability management lifecycle across infrastructure, cloud, and application environments. This role involves providing strategic oversight, risk-based prioritization, and cross-functional collaboration with IT managers and business stakeholders to ensure timely remediation. Key responsibilities include developing reporting metrics, mentoring junior professionals, and supporting regulatory compliance. The successful candidate will utilize expertise in CVE, CVSS, and CWE frameworks alongside platforms like Qualys, Tanium, and Rapid7. Technical skills include experience with DAST/SAST tools such as Fortify, Checkmarx, and Veracode, as well as analytics tools like Power BI or Tableau. The role addresses the business problem of transforming reactive security responses into proactive risk management across large-scale, distributed enterprise environments.
Lead the enterprise-wide vulnerability management lifecycle across infrastructure, cloud, and application environments.
Coordinate with application teams and IT managers to ensure timely remediation of security vulnerabilities.
Develop reporting programs and metrics to provide executive leadership with visibility into security risks.
Mentor junior security professionals and improve program maturity through governance and tooling strategies.
Support regulatory compliance and audit activities by aligning with enterprise security policies and standards.
Establish and monitor key performance indicators to drive measurable improvements in vulnerability remediation.
What we're looking for
7+ years of operational security experience in vulnerability management, application security testing, or technical project management in large-scale enterprise environments.
Deep expertise in vulnerability assessment frameworks including CVE, CVSS, and CWE using platforms like Qualys, Tanium, or Rapid7.
Strong application security knowledge to assess risk, map vulnerabilities to exploitation techniques, and provide actionable business recommendations.
Experience with DAST/SAST platforms such as Fortify, Checkmarx, Veracode, or equivalent application security testing solutions.
Bachelor's degree in Computer Science, Cybersecurity, Information Technology, or equivalent professional experience in information security roles.
Proven leadership and influence capabilities to drive cross-functional initiatives and stakeholder alignment without direct authority.
Relevant information security certifications such as CISSP, CISM, CEH, GCIH, or equivalent industry-recognized credentials.
Proficiency in security reporting tools like Power BI or Tableau and knowledge of NIST or ISO 27001 frameworks (preferred).