AM Public-Dallas-Associate-Security Engineering

Goldman Sachs • Dallas, TX

12d

About The Position

The Information Security Officer for Asset Management is a leadership position responsible for defining, implementing, and overseeing the information security and cybersecurity risk posture within the Asset Management Private business. The role balances commercial objectives with security controls, strengthens resilience against evolving threats, and protects client assets and data. It provides strategic direction to Governance, Risk & Compliance (GRC), Application Security & Advisory, and Product Security teams, and oversees embedded Technology Risk Officers across Asset Management Private business verticals. The position aims to promote unified, proactive risk management, regulatory compliance, and secure technological innovation.

The role works with application development teams to communicate security and business resiliency controls and help integrate them into critical business applications. It also collaborates with global technology risk functions, advises on risk assessment and mitigation, evaluates application design risks, and supports remediation. The position guides engineering leaders and developers on web and mobile threats, promotes security controls throughout the Software Development Life Cycle (SDLC), and provides expertise in secure application design, development, standards, solutions, tools, and customized security testing strategies.

Requirements

• 3–5 years of progressive experience in multiple Information Security domains, such as vendor security, application security, vulnerability management, data loss prevention, data encryption, and infrastructure security.
• Expert knowledge of global financial regulations, such as SEC, FINRA, GDPR, and CCPA, and experience applying risk management methodologies such as FAIR or similar frameworks.
• Proven ability to build, mentor, and lead high-performing global teams of security professionals.
• Proven track record collaborating with engineering, technology, second-line risk functions, and audit partners to deliver projects and resolve audit issues within committed timelines.
• Exceptional written and oral communication skills, including the ability to explain complex technical risks and solutions to technical and executive audiences.
• Expertise in conducting risk assessments, identifying information security policy compliance gaps, and recommending effective mitigation strategies.
• Familiarity with security standards and frameworks such as NIST, OWASP, SANS Top 20, PCI DSS, and CIS Controls.
• Expertise in Technology Risk data analytics, including metrics reporting and dashboarding.
• Knowledge of Software Development Lifecycle best practices, including code reviews and vulnerability scan report analysis, to advise application development teams on secure practices and frameworks.

Nice To Haves

• BS or MS degree in Computer Science, Cyber Security, Information Security, or a related technical field.
• Relevant industry certifications such as CISSP, CISM, CRISC, or CISA, or cloud-specific security certifications such as AWS Certified Security – Specialty.
• Experience leveraging AI/ML to solve security problems and scale operations.
• Knowledge of secure coding languages such as Python, Java, or Go.

Responsibilities

• Work with application development teams to explain Information Security and Business Resiliency control requirements and advise on integrating controls into business applications.
• Collaborate with global Application Security Risk, Business Continuity, Risk Measurement, and other Technology Risk teams to develop and integrate security and resiliency controls and practices.
• Communicate technology risk impacts and approaches to mitigation or acceptance, and provide risk assessment and advisory services to engineers and technology and business management.
• Assess existing applications for design-related security risks and help teams determine remediation steps.
• Guide engineering leadership and application developers on existing and emerging web and mobile application threats.
• Drive adoption of embedded application security controls as part of the Software Development Life Cycle (SDLC).
• Provide subject matter expertise to application teams on secure application design and development approaches and techniques.
• Contribute to the technical understanding, adoption, and convergence of information security standards, solutions, and tools.
• Work with engineers to develop customized security testing strategies that complement the Technology Risk-managed security testing program.
• Provide strategic direction to teams responsible for GRC, Application Security & Advisory, and Product Security.
• Oversee and guide embedded Technology Risk Officers assigned to Asset Management Private business verticals.

Benefits

• Training and development opportunities.
• Firmwide networks.
• Benefits and wellness offerings.
• Personal finance offerings.
• Mindfulness programs.
• Reasonable accommodations for candidates with special needs or disabilities during the recruiting process.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed