Engineering- Dallas- Associate, Risk Governance – 10431267

Goldman Sachs•Dallas, TX

13d•Onsite

About The Position

Goldman Sachs & Co. LLC is seeking an Associate, Risk Governance in Dallas, Texas. This role involves leading and executing division-wide Risk and Control Self-Assessment (RCSA) initiatives globally to ensure compliance with US and international regulatory standards. The position requires conducting RCSAs across various engineering processes, identifying operational and compliance risks, and optimizing analytical tools for reporting. A key aspect of the role is designing and implementing preventive and detective controls within engineering workflows, including the use of Generative AI for automation. The Associate will also triage incidents, perform root-cause analysis, coordinate audit responses, and prepare materials for risk committees. Promoting a strong risk culture through training and onboarding is also a responsibility. The role includes uplifting the risk taxonomy, identifying new controls, and recommending best practices for control testing and remediation within GS Engineering areas.

Requirements

Master’s degree (U.S. or foreign equivalent) in Computer Science, Information Systems, Management Science, Cyber Security, or a related field, and one (1) year of experience in the job offered or in a related role OR Bachelor’s degree (U.S. or foreign equivalent) in Computer Science, Information Systems, Management Science, Cyber Security, or a related field, and three (3) years of experience in the job offered or in a related role.
Prior experience must include one (1) year of experience (with Master’s) or three (3) years of experience (with Bachelor’s) with risk Frameworks including NIST Cybersecurity Framework (CSF).
Prior experience must include one (1) year of experience (with Master’s) or three (3) years of experience (with Bachelor’s) with performing statistically driven analysis using various data analytical techniques to identify trends and propose process enhancements.
Prior experience must include one (1) year of experience (with Master’s) or three (3) years of experience (with Bachelor’s) with visualizing complex data analyses from raw data in risk management reports, using visualization tools such as Tableau, and communicating results to a wide variety of audiences.
Prior experience must include one (1) year of experience (with Master’s) or three (3) years of experience (with Bachelor’s) with leveraging analytics and automation experience to propose effective and efficient methods to enhance testing and sampling strategies to ensure the most effective risk detection and analyses.
Prior experience must include one (1) year of experience (with Master’s) or three (3) years of experience (with Bachelor’s) with developing processes and tools to identify and monitor data accuracy.

Nice To Haves

Experience with Generative AI tools (e.g., GitHub Copilot, internal LLM copilots, agentic workflow platforms).
Experience with SDLC, CI/CD pipelines, cloud infrastructure, and production change management.
Experience with identifying operational risks (e.g. Technology operations risks, infosec and cyber risks, third party risks, data loss) and compliance risks (e.g., data privacy, records management, regulatory reporting integrity).
Experience with analytical tools and dashboards for RCSA and SOX mandates.
Experience designing and operationalizing preventive and detective controls.
Experience with root-cause analysis.
Experience coordinating responses to internal audit findings.
Experience preparing materials for risk committees and senior management forums.
Experience promoting risk culture through training and onboarding.
Experience with risk taxonomy and control identification.
Experience with control testing techniques such as data analysis, code review, re-performance of processing logic, observation and interviews.

Responsibilities

Lead and execute division-wide Risk and Control Self-Assessment (RCSA) initiatives across the global enterprise to ensure full alignment with US and international regulatory standards.
Conduct Risk and Control Self-Assessments (RCSAs) across engineering processes including SDLC, CI/CD pipelines, cloud infrastructure, and production change management.
Partner with engineering teams to identify operational risks (e.g. Technology operations risks, infosec and cyber risks, third party risks, data loss) and compliance risks (e.g., data privacy, records management, regulatory reporting integrity).
Drive the review, and optimization of analytical tools and dashboards to streamline the assessment, visualization, and reporting of RCSA and SOX mandates.
Design, document, and operationalize preventive and detective controls embedded within engineering workflows (e.g., automated policy-as-code, pipeline gates, access provisioning checks).
Use Generative AI tools (e.g., GitHub Copilot, internal LLM copilots, agentic workflow platforms) to automate control evidence collection and summarization, draft policies, risk assessments, and audit responses and triage and classify incidents and risk events at scale.
Triage operational incidents and near-misses originating from engineering systems; perform root-cause analysis with SRE and engineering leads.
Coordinate responses to internal audit findings, 2LoD challenge related to engineering processes.
Prepare materials for Engineering Risk Committees and senior management forums; translate technical risk into business language.
Promote a strong risk culture through training, lunch-and-learns, and onboarding for new engineers.
Uplift risk taxonomy to reflect changes to risk profile for the Engineering Division - Identify new controls to effectively mitigate any gaps in risk exposure.
Recommend best practices for design and execution of controls testing within GS Engineering areas and to validate the remediation of identified system control weaknesses, utilizing various techniques such as data analysis, code review, re-performance of processing logic, observation and interviews to evaluate the adequacy of operational and compliance risks and controls.