AM Public-Dallas-Associate-Security Engineering

Goldman Sachs•Dallas, TX

About The Position

The Information Security Officer for Asset Management is responsible for defining, implementing, and overseeing the information security and cybersecurity risk posture within the Asset Management Private business. The role balances commercial objectives with robust security controls, supports resilience against evolving threats, and protects client assets and data. The position provides strategic direction to teams responsible for Governance, Risk & Compliance (GRC), Application Security & Advisory, and Product Security. It also oversees and guides embedded Technology Risk Officers assigned to Asset Management Private business verticals, supporting a unified and proactive approach to risk management, regulatory compliance, and secure technological innovation.

Requirements

3–5 years of progressive, multidomain Information Security experience, such as vendor security, application security, vulnerability management, data loss prevention, data encryption, and infrastructure security.
Expert knowledge of global financial regulations, including examples such as SEC, FINRA, GDPR, and CCPA, and proven experience applying risk management methodologies such as FAIR or similar frameworks.
Proven ability to build, mentor, and lead high-performing global teams of security professionals.
Track record of collaborating with engineering, technology, second-line risk functions, and audit partners to deliver projects and resolve audit issues within committed timelines.
Exceptional written and oral communication skills, including the ability to explain complex technical risks and solutions to technical and executive audiences.
Expertise in performing risk assessments, identifying information security policy compliance gaps, and recommending mitigation strategies.
Familiarity with security standards and frameworks such as NIST, OWASP, SANS Top 20, PCI DSS, and CIS Controls.
Expertise in Technology Risk data analytics, including metrics reporting and dashboarding, and reviewing SDLC practices such as code reviews and vulnerability scan report analysis to advise application teams on secure practices and frameworks.

Nice To Haves

BS or MS degree in Computer Science, Cyber Security, Information Security, or a related technical field.
Relevant certifications such as CISSP, CISM, CRISC, CISA, or cloud-specific security certifications such as AWS Certified Security – Specialty.
Experience leveraging AI/ML to solve security problems and scale operations.
Knowledge of secure coding languages such as Python, Java, or Go.

Responsibilities

Work with internal application development teams to explain Information Security and Business Resiliency control requirements and advise on integrating those controls into applications.
Collaborate with global Application Security Risk, Business Continuity, Risk Measurement, and other Technology Risk teams to develop and integrate security and resiliency controls and practices.
Communicate technology risk impacts and mitigation or acceptance approaches, and provide risk assessment and advisory services to technology engineers and technology and business management.
Assess existing applications for design-related security risks and help teams determine appropriate remediation steps.
Guide engineering leadership and application developers on existing and emerging threats in web and mobile applications.
Drive adoption of embedded application security controls within the Software Development Life Cycle (SDLC).
Provide application teams with subject matter expertise in secure application design and development approaches and techniques.
Contribute to the technical understanding, adoption, and convergence of information security standards, solutions, and tools.
Work with engineers to develop customized security testing strategies that complement the existing Technology Risk security testing program.