Sr Information Security Lead

Segment: S&P Global Platts Grade: 12 The Location: Hyderabad/Gurgaon The Role : Sr. Security Analyst- Vulnerability Management The Team: You will be working within the Operations team within Platts in either Hyderabad or Gurgaon. What’s in it for you: Working in a global application support team supporting users based in three time zones and across 26 offices. Exposure to application support, operations, monitoring and projects in a role where you will interact directly with the business and learn the products and systems required to support the Platts business operations Responsibilities: A successful candidate for this position will have: • Excellent communication skills, with an emphasis on the ability to communicate security topics, policies, and standards with non-technical people • Understanding of how applications, cloud networking, operating systems, and databases work • Good understanding of information security standards like NIST - Cybersecurity framework, ISO 27001, and risk management methodologies • Excellence at stakeholder engagement and build strong partnerships across the technology and business teams • Sound knowledge of common infrastructure and web application vulnerability categorizations such as CVE, CVSS, CWE • Experience with performing complex network vulnerability scans in both on-prem and cloud environments using common vulnerability assessment tools • Experience in analyzing, identifying, and developing remediation plans for vulnerabilities until full closure • In-depth understanding of application & web-based attacks and remediation • Experience in configuring different types of scans using the Qualys tool or related experience in DAST/SAST tools • Excellent interpersonal skills and ability to analyze issues while balancing the business need with the required level of security posture • Use an analytical approach to build and troubleshoot automation pipelines driving significant risk reduction and surfacing risk posture across the organization • The willingness to participate in different rotational shift schedules as required What We’re Looking For: Responsibilities will include, but are not limited to, the following: • Engage with Application Technical Leads and IT managers to communicate the importance of vulnerability remediation from a technical perspective • Provide recommendations and technical guidance for the lifecycle of open-source software libraries • Track and monitor key milestones or after significant change in the environment to identify network, infrastructure, and configuration vulnerabilities • Use automation, orchestration, and scripting to reduce manual processes, improving overall efficiency to meet our rapidly changing needs • Perform ad-hoc data remediation, clean-ups, and reporting using large complex data sets for rapid security responses • Develop reports using data that is hosted in multiple sources/tools (e.g., spreadsheets, databases) and communicate clearly to leadership and other cyber security teams • Curation and assessment of vulnerability data extracts to analyze and resolve false positives • Support new project, programs or initiatives with vulnerabilities scanning of new or existing assets as required • Review and risk assess the criticality and priority of all vulnerability scans along with existing toolset for prioritization Education: Bachelor’s Degree in Computer Science, Information Systems, or equivalent work-related experience. Basic Qualifications: • 10-12 years in a professional environment preferably as part of an operational security function (Vulnerability management, application testing, penetration testing, technical project management) • Minimum of 7 years on a large-scale vulnerability management engagement • Prior experience in a large and complex organization, operating across numerous locations and with a high degree of change. • Experience reproducing proof of concept exploitation steps. • Experience judging the priority of a vulnerability based on risk and impact. • Experience securing applications and infrastructure in Amazon Web Services and similar IaaS / PaaS platforms. • Deep application security knowledge, with the ability to map an application vulnerability to exploitation indications and relevant investigative techniques. • Relevant incident response or information security certifications, such as CEH, Security+, GSEC, GCIH, etc. About S&P Global Platts At S&P Global Platts, we provide the insights; you make better informed trading and business decisions with confidence. We’re the leading independent provider of information and benchmark prices for the commodities and energy markets. Customers in over 150 countries look to our expertise in news, pricing and analytics to deliver greater transparency and efficiency to markets. S&P Global Platts coverage includes oil and gas, power, petrochemicals, metals, agriculture and shipping. S&P Global Platts is a division of S&P Global (NYSE: SPGI), which provides essential intelligence for individuals, companies and governments to make decisions with confidence. For more information, visit www.platts.com. S&P Global has a Securities Disclosure and Trading Policy (“the Policy”) that seeks to mitigate conflicts of interest by monitoring and placing restrictions on personal securities holding and trading. The Policy is designed to promote compliance with global regulations. In some Divisions, pursuant to the Policy’s requirements, candidates at S&P Global may be asked to disclose securities holdings. Some roles may include a trading prohibition and remediation of positions when there is an effective or potential conflict of interest. Employment at S&P Global is contingent upon compliance with the Policy. Equal Opportunity Employer: S&P Global is an equal opportunity employer and all qualified candidates will receive consideration for employment without regard to race/ethnicity, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, marital status, military veteran status, unemployment status, or any other status protected by law. Only electronic job submissions will be considered for employment. If you need an accommodation during the application process due to a disability, please send an email to: [email protected] and your request will be forwarded to the appropriate person. ----------------------------------------------------------- Equal Opportunity Employer S&P Global is an equal opportunity employer and all qualified candidates will receive consideration for employment without regard to race/ethnicity, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, marital status, military veteran status, unemployment status, or any other status protected by law. Only electronic job submissions will be considered for employment. If you need an accommodation during the application process due to a disability, please send an email to: [email protected] and your request will be forwarded to the appropriate person.  US Candidates Only: The EEO is the Law Poster http://www.dol.gov/ofccp/regs/compliance/posters/pdf/eeopost.pdf describes discrimination protections under federal law. ----------------------------------------------------------- 103 - Middle Management (EEO Job Group) (inactive), 10 - Officials or Managers (EEO-2 Job Categories-United States of America), IFTECH103.2 - Middle Management Tier II (EEO Job Group) Job ID: 271473 Posted On: 2022-06-17 Location: Gurgaon, Haryana, India