Head of Technology Risk, Governance, and Controls

About the Role

Grade Level (for internal use): 15

Head of Technology Risk, Governance, and Controls

The Impact

The Head of Technology Risk and Governance works directly with the Senior Vice President, Chief Information Officer (CIO) to own the strategy and oversight of first-line risk across the broader technology organization. The role will ensure the integrity of S&P Global systems by managing our internal controls, owning and ensuring completion of MAPs, SOX controls, any audits from a technology perspective, regulatory compliance, and our overall risk posture. This role works in partnership with key stakeholders in Information Security, divisional technology teams, Corporate functions, our Enterprise Data Organization, as well as with Enterprise Risk and Compliance, Internal Audit, and External Auditor.

Responsibilities and Impact

• Lead the technology risk and governance strategy by driving risk initiatives in support of the Enterprise Technology and Transformation strategy to protect our brand, enable business-focused capabilities, and lead with innovation.
• Ownership and liaison for SOX controls with Finance, Internal Audit and External Auditor including responsibility for the annual testing of related IT SOX controls and deficiency remediation.
• Scale and optimize the first-line of defense to proactively identify and mitigate technology risk across the firm.
• Work in tandem with the Enterprise Risk and Compliance team to contribute to the enterprise risk appetite and taxonomy, and design and operate the controls that implement them within technology.
• Operationalize the enterprise risk framework within technology and establish the technology-specific governance needed to run the first line, in coordination with information security.
• Establish and track KPIs and KRIs related to technology risk and compliance across all technology teams; create consistency in measuring and reporting.
• Collaborate with senior stakeholders across the enterprise to integrate risk management into strategic planning, product development, and operational rigor.
• Lead risk assessments and partner with Internal Audit to ensure compliance and identify areas for improvement.
• Drive a culture of risk awareness and continuous improvement, ensuring compliance to industry standards. Create risk awareness programs designed to improve the risk fluency of our technology organization.
• Own first-line management of technology risk arising from third parties, external platforms, cloud providers, and critical dependencies—including concentration and continuity exposure—partnering with Procurement / Third-Party Risk Management and the second-line dependency function.
• Own identification, remediation planning, tracking to closure, and timely escalation of technology risks, control issues, and audit action plans across the organization.
• Design, implement, and operate the technology control environment, including control self‑assessment and the production of audit‑ and oversight‑ready evidence.
• Embed first-line risk management and controls for AI including model and use‑case inventory, secure deployment, monitoring, and control operation.
• Strengthen operational resilience and continuity for critical technology services, including availability and recovery expectations.
• Map regulatory and compliance obligations affecting technology into the control environment, ensuring traceability between obligations, controls, and evidence.

Basic Required Qualifications

• Minimum of 15 years of experience in technology risk management and internal controls implementation, including both building and operating a function, including people management experience.
• Strong stakeholder relationship acumen to navigate issue resolution and urgency with internal and external stakeholders.
• Able to convey complex risk topics, including progress of remediation efforts, statuses of issues, etc. to varied audiences (e.g., executive leadership, technical teams, audit, etc).
• Successful track record in working in a global environment, with the ability to create constructive relationships and communicate across various organizational teams.
• Exceptional analytical skills and problem‑solving abilities, with proven experience in prioritizing and executing tasks in a high‑pressure environment.
• Deep familiarity with technology risk and control frameworks such as NIST CSF, ISO 27001, COBIT, and SOX IT General Controls.
• Understanding of emerging technology risk domains including AI/ML, cloud, and data privacy; ability to develop risk approaches for novel and evolving technology landscapes.
• Must be in reasonable distance of one of our office locations. Role will be required to be in office at least 2 days per week.

Additional Preferred Qualifications

• Experience applying risk and control frameworks in a regulated environment.
• Hands‑on experience with GRC platforms (e.g., ServiceNow GRC, Archer, or equivalent) to operationalize governance and reporting at scale.
• Relevant professional certifications such as CRISC, CISM, CISSP, or equivalent.
• Experience working with core AI capabilities such as Microsoft Copilot, Claude, or ChatGPT, particularly in solving business problems through custom agents or workflows.
• Demonstrated experience operating within a Three Lines model, partnering with an independent second-line risk function and Internal Audit organization, without duplicating accountability.
• Experience assessing third-party, vendor, and cloud‑dependency technology risk, including operational resilience and concentration implications.
• Master of Business Administration or Engineering or related discipline.

Salary and Benefits

S&P Global states that the anticipated base salary range for this position is $220,000 to $350,000. Final base salary for this role will be based on the individual’s geographic location, as well as experience level, skill set, training, licenses and certifications.

In addition to base compensation, this role is eligible for an annual incentive plan. This role is not eligible for additional compensation such as an annual incentive bonus or sales commission plan.

This role is eligible to receive additional S&P Global benefits. For more information on the benefits we provide to our employees, see

Benefits

• Health & Wellness: Health care coverage designed for the mind and body.
• Flexible Downtime: Generous time off helps keep you energized for your time on.
• Continuous Learning: Access a wealth of resources to grow your career and learn valuable new skills.
• Invest in Your Future: Secure your financial future through competitive pay, retirement planning, a continuing education program with a company‑matched student loan contribution, and financial wellness programs.
• Family Friendly Perks: It’s not just about you. S&P Global has perks for your partners and little ones, too, with some best‑in class benefits for families.
• Beyond the Basics: From retail discounts to referral incentive awards—small perks can make a big difference.

Equal Opportunity Employer

S&P Global is an equal opportunity employer and all qualified candidates will receive consideration for employment without regard to race/ethnicity, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, marital status, military veteran status, unemployment status, or any other status protected by law. Only electronic job submissions will be considered for employment.

If you need an accommodation during the application process due to a disability, please send an email to: View email address on click.appcast.io and your request will be forwarded to the appropriate person.

Location: New York, New York, United States