Engineering - Dallas - Vice President, Security Engineering - 3381787

Goldman Sachs•Dallas, TX

11h•Onsite

About The Position

Goldman Sachs Services LLC is seeking a Vice President, Security Engineering in Dallas, Texas. This role involves performing comprehensive application security assessments, including code reviews, penetration testing, design reviews, and threat modeling. The position requires communicating assessment results to application engineers, reviewing and documenting application security architecture, policies, and standards. A key responsibility is identifying vulnerabilities in software applications and design processes to mitigate security risks. The role also includes researching new cloud services for secure Firm utilization, analyzing security threats and risks by understanding software component design architectures, and performing security threat analysis to determine exploit vectors. Additionally, the position involves writing and socializing test cases, documenting issues with remediation recommendations, advising component owners on secure implementation, and staying current with new technologies to assist engineers in risk assessment. The role contributes to a world-class cyber defense program by collaborating with technical, incident management, and forensic personnel to understand cyber threat actor activities and provides security consulting within the Firm.

Requirements

Master’s degree (U.S. or foreign equivalent) in Cyber Security, Computer Science, Computer Engineering or a related field and three (3) years of experience in the job offered or a related Security Engineering role OR bachelor’s degree (U.S. or foreign equivalent) in Cyber Security, Computer Science, Computer Engineering or a related field and five (5) years of experience in the job offered or a related Security Engineering role.
Three (3) years of experience (with a Master’s degree) or five (5) years of experience (with a Bachelor’s degree) with reviewing security controls and how they apply to different designs and systems in order to identify security gaps.
Three (3) years of experience (with a Master’s degree) or five (5) years of experience (with a Bachelor’s degree) with highlighting and articulating risk to developers or engineers in an understandable language.
Three (3) years of experience (with a Master’s degree) or five (5) years of experience (with a Bachelor’s degree) with performing application vulnerability assessment and penetration testing of web applications.
Three (3) years of experience (with a Master’s degree) or five (5) years of experience (with a Bachelor’s degree) with performing code review of web application programming languages such as Java.
Two (2) years of experience with performing assessments of technologies leveraging common web stack technologies such as Java.
Two (2) years of experience with performing architecture review of web applications.

Responsibilities

Perform Application Security Assessments (Code Review, Penetration Test, Design Review, Threat modelling) and communicate the results to the respective application engineers.
Review Application Securing architecture, policies, standards definitions, and carry out documentation of the above.
Identify vulnerabilities in software applications and software designing processes to reduce security risks.
Actively research new cloud services and identify ways in which the Firm can leverage the Cloud in a secure manner.
Work with stakeholders to understand the design architecture of software components to analyze security threats and risks.
Perform security threat analysis to determine the exploit vectors and paths for software components.
Write and socialize test cases to verify assumptions from threat analysis.
Document issues along with detailed recommendations for how to address issues.
Share issues and recommendations with component owners and advise on how they can implement secure remediation.
Stay up to date with new technologies and assist engineers in assessing risk.
Enable a world-class cyber defense program by working closely with other technical, incident management, and forensic personnel to develop a fuller understanding of activity of cyber threat actors.
Provide security consulting within the Firm as needed.