Head of Technology Risk, Governance, and Controls

About the Role

Grade Level (for internal use): 15

Head of Technology Risk, Governance, and Controls

The Team:
Digital Technology (DT) is an enterprise-shared technology organization enabling people, functions, and divisions. We drive S&P Global to advance essential intelligence by working as trusted partners delivering secure, scalable, resilient, and innovative products and services that create value and enable superior experiences for our people and customers.

The Head of Technology Risk and Governance works directly with the Senior Vice President, Chief Information Officer (CIO) to own the strategy and oversight of first-line risk across the broader technology organization. The role will ensure the integrity of S&P Global systems by managing our internal controls, owning and ensuring completion of MAPs, SOX controls, any audits from a technology perspective, regulatory compliant, and our overall risk posture.

This role works in partnership with key stakeholders in Information Security, divisional technology teams, Corporate functions, our Enterprise Data Organization, as well as with Enterprise Risk and Compliance, Internal Audit, and External Auditor.

This is a first-line-of-defense role. The Head owns the identification, assessment, mitigation, and day-to-day management of the technology risks this organization creates. Accountability for designing and operating the controls, owning the risks and their remediation, and embedding risk management into how technology builds and runs.

• Lead the technology risk and governance strategy by driving risk initiatives in support of the Enterprise Technology and Transformation strategy to protect our brand, enable business-focused capabilities, and lead with innovation.
• Ownership and liaison for SOX controls with Finance, Internal Audit and External Auditor including responsibility for the annual testing of related IT SOX controls and deficiency remediation.
• Scale and optimize the first-line of defense to proactively identify and mitigate technology risk across the firm.
• Work in tandem with the Enterprise Risk and Compliance team to contribute to the enterprise risk appetite and taxonomy, and design and operate the controls that implement them within technology.
• Operationalize the enterprise risk framework within technology and establish the technology-specific governance needed to run the first line, in coordination with information security.
• Establish and track KPIs and KRIs related to technology risk and compliance across all technology teams; create consistency in measuring and reporting.
• Collaborate with senior stakeholders across the enterprise to integrate risk management into strategic planning, product development, and operational rigor.
• Lead risk assessments and partner with Internal Audit to ensure compliance and identify areas for improvement.
• Drive a culture of risk awareness and continuous improvement, ensuring compliance to industry standards.
• Create risk awareness programs designed to improve the risk fluency of our technology organization.
• Own first-line management of technology risk arising from third parties, external platforms, cloud providers, and critical dependencies—including concentration and continuity exposure—partnering with Procurement / Third-Party Risk Management and the second-line dependency function.
• Own identification, remediation planning, tracking to closure, and timely escalation of technology risks, control issues, and audit action plans across the organization.
• Design, implement, and operate the technology control environment, including control self-assessment and the production of audit- and oversight-ready evidence.
• Embed first-line risk management and controls for AI including model and use-case inventory, secure deployment, monitoring, and control operation.
• Strengthen operational resilience and continuity for critical technology services, including availability and recovery expectations.
• Map regulatory and compliance obligations affecting technology into the control environment, ensuring traceability between obligations, controls, and evidence.