AM Public-Dallas-Vice President-Security Engineering

Goldman Sachs•Dallas, TX

11d

About The Position

The Lead Information Security Officer for Asset Management is a leadership role responsible for defining, implementing, and overseeing the information security and cybersecurity risk posture within the Asset Management Private business. The role balances commercial objectives with robust security controls, supports resilience against evolving threats, and protects client assets and data. The position provides strategic direction to teams responsible for Governance, Risk & Compliance (GRC), Application Security & Advisory, and Product Security. It also oversees and guides embedded Technology Risk Officers assigned to Asset Management Private business verticals, fostering coordinated risk management, regulatory compliance, and secure technological innovation. The role advises application development teams on security and business resiliency controls, assesses application risks, promotes secure development practices, and collaborates with global Technology Risk and related teams to develop and integrate security and resiliency controls.

Requirements

At least 5 years of progressive, multidomain information security experience, such as vendor security, application security, vulnerability management, data loss prevention, data encryption, and infrastructure security.
Expert knowledge of global financial regulations, including examples such as SEC, FINRA, GDPR, and CCPA, and experience applying risk management methodologies such as FAIR or similar frameworks.
Demonstrated ability to build, mentor, and lead high-performing global teams of security professionals.
A track record of collaborating with engineering, technology, second-line risk functions, and audit partners to deliver projects and resolve audit issues within committed timelines.
Exceptional written and oral communication skills, including the ability to explain complex technical risks and solutions to technical and executive audiences.
Expertise in performing risk assessments, identifying information security policy compliance gaps, and recommending effective mitigation strategies.
Familiarity with security standards and frameworks such as NIST, OWASP, SANS Top 20, PCI DSS, and CIS Controls.
Expertise in Technology Risk data analytics, including metrics reporting and dashboarding, and reviewing SDLC practices such as code reviews and vulnerability scan reports to advise application teams on secure practices and frameworks.

Nice To Haves

BS or MS degree in Computer Science, Cyber Security, Information Security, or a related technical field.
Relevant industry certifications such as CISSP, CISM, CRISC, CISA, or cloud-specific security certifications such as AWS Certified Security – Specialty.
Experience leveraging AI/ML to solve security problems and scale operations.
Knowledge of secure coding languages such as Python, Java, or Go.

Responsibilities

Work with internal application development teams to explain Information Security and Business Resiliency control requirements and advise on integrating those controls into applications.
Collaborate with global Application Security Risk, Business Continuity, Risk Measurement, and other global Technology Risk teams to develop and integrate security and resiliency controls and practices.
Communicate technology risks and mitigation or acceptance approaches, and provide risk assessment and advisory services to technology engineers and technology and business management.
Assess existing applications for design-related security risks and help teams determine remediation steps.
Guide engineering leaders and application developers on existing and emerging web and mobile application threats.
Drive adoption of embedded application security controls in the Software Development Life Cycle (SDLC).
Provide application teams with subject matter expertise in secure application design and development approaches and techniques.
Contribute to technical understanding, adoption, and convergence of information security standards, solutions, and tools.
Work with engineers to develop customized security testing strategies that complement the Technology Risk security testing program.
Define, implement, and oversee the information security and cybersecurity risk posture for the Asset Management Private business.
Provide strategic direction to GRC, Application Security & Advisory, and Product Security teams.
Oversee and guide embedded Technology Risk Officers assigned to Asset Management Private business verticals.