AM Public-Dallas-Vice President-Security Engineering

Goldman Sachs•Dallas, TX

10d

About The Position

The Lead Information Security Officer for Asset Management is responsible for defining, implementing, and overseeing the information security and cybersecurity risk posture within the Asset Management Private business. The role balances commercial objectives with security controls, supports resilience against evolving threats, and protects client assets and data. It provides strategic direction to teams responsible for Governance, Risk & Compliance (GRC), Application Security & Advisory, and Product Security, and oversees embedded Technology Risk Officers assigned to Asset Management Private business verticals. The position works with application development teams to integrate information security and business resiliency controls into critical applications. It collaborates with global Application Security Risk, Business Continuity, Risk Measurement, and other Technology Risk teams to develop security and resiliency practices. The role assesses application security risks, advises on threats and remediation, promotes security controls throughout the software development life cycle, and provides risk assessment and advisory services to technology and business stakeholders.

Requirements

At least 5 years of progressive experience across multiple information security domains, such as vendor security, application security, vulnerability management, data loss prevention, data encryption, and infrastructure security.
Expert knowledge of global financial regulations, such as SEC, FINRA, GDPR, and CCPA.
Proven experience applying risk management methodologies such as FAIR or similar frameworks.
Proven ability to build, mentor, and lead high-performing global security teams.
Track record of collaborating with engineering, technology, second-line risk functions, and audit partners to deliver projects and resolve audit issues within committed timelines.
Exceptional written and oral communication skills, including the ability to explain complex technical risks and solutions to technical and executive audiences.
Expertise in conducting risk assessments, identifying information security policy compliance gaps, and recommending effective mitigations.
Familiarity with security standards and frameworks such as NIST, OWASP, SANS Top 20, PCI DSS, and CIS Controls.
Expertise in Technology Risk data analytics, including metrics reporting and dashboarding.
Experience reviewing SDLC practices, such as code reviews and vulnerability scan reports, to advise application development teams on secure practices, frameworks, and application security best practices.

Nice To Haves

BS or MS degree in Computer Science, Cyber Security, Information Security, or a related technical field.
Relevant certifications such as CISSP, CISM, CRISC, CISA, or cloud-specific security certifications such as AWS Certified Security – Specialty.
Experience leveraging AI/ML to solve security problems and scale operations.
Knowledge of secure coding languages such as Python, Java, and Go.

Responsibilities

Work with application development teams to explain information security and business resiliency control requirements and advise on integrating controls into applications.
Collaborate with global Application Security Risk, Business Continuity, Risk Measurement, and Technology Risk teams to develop and integrate security and resiliency controls and practices.
Communicate technology risks and approaches to mitigation or acceptance, and provide risk assessment and advisory services to engineers and technology and business management.
Assess existing applications for design-related security risks and help teams determine remediation steps.
Guide engineering leaders and application developers on existing and emerging web and mobile application threats.
Drive adoption of embedded application security controls in the Software Development Life Cycle (SDLC).
Provide application teams with subject matter expertise in secure application design and development.
Contribute to the technical understanding, adoption, and convergence of information security standards, solutions, and tools.
Work with engineers to develop customized security testing strategies that complement the Technology Risk security testing program.
Define, implement, and oversee the information security and cybersecurity risk posture for Asset Management Private.
Provide strategic direction to GRC, Application Security & Advisory, and Product Security teams, and oversee embedded Technology Risk Officers.