Risk, Technology Operational Risk – CORE Engineering Risk, Vice President, Dallas

Goldman Sachs•Dallas, TX

About The Position

The Vice President will work in Goldman Sachs’ Operational Risk Department, an independent risk management function responsible for developing and implementing a standardized framework to identify, measure, and monitor operational risk across the firm. The role focuses on AI Coverage and strengthens oversight of operational risks arising from the firm’s adoption and use of artificial intelligence. The successful candidate will continuously identify, monitor, measure, and assess risks associated with AI platforms, foundational models, agentic systems, and their supporting infrastructure, vendors, and data. The role helps ensure the firm’s AI footprint is built, operated, and governed consistently with operational resilience, third-party risk, and data governance frameworks, policies, and standards. Candidates may bring deep expertise in one or more adjacent risk disciplines, grounded in direct experience evaluating or managing risk in AI, machine learning, or agentic technology environments. The role covers AI resilience and operational continuity, third-party and supply-chain risk, and data governance. It includes assessing resilience risks such as infrastructure or model outages, non-deterministic behavior under stress, cascading agent failures, data drift, and service-provider unavailability; ensuring AI systems supporting Important Business Services are reflected in continuity plans and supported by workarounds; and challenging resilience controls and testing. It also involves monitoring AI vendors and supply chains, overseeing due diligence and model validation, and assessing AI-related data inventory, ownership, quality, lineage, authoritative sources, defects, and requests. The position also conducts analysis of AI availability, observability, vendor performance, and data quality; supports incident reporting, risk profile assessments, RCSA review and challenge, and New Activity reviews; monitors regulatory and industry developments; and drives improvements to AI risk management practices. The Risk division is responsible for credit, market and operational risk, model risk, independent liquidity risk, and insurance throughout the firm.

Requirements

Strong understanding of operational resilience, including BCP and impact tolerances, third-party risk management, including vendor due diligence and SLA governance, and/or data governance, including data lineage, data quality, and ADS/PDE frameworks; direct experience applying one or more of these disciplines to AI/ML systems is required.
Strong understanding of AI/ML architecture, including foundation models, LLMs, RAG systems, agentic AI frameworks, MCP servers, vector databases, and model deployment infrastructure.
Experience with resilience-by-design, AI vendor or supply-chain controls, or data quality control frameworks applied to AI pipelines.
Knowledge of relevant control frameworks such as NIST 800-53, NIST AI 600-1, ISO 27001, EU AI Act, and/or the firm's Data Governance Policy/Standard.
7+ years of relevant experience in operational risk, resilience/BCP, third-party risk management, data governance, a financial institution's technology division, or a technology company building or maintaining enterprise AI/ML systems.
Strong verbal and written communication skills, including the ability to present with impact and influence.
Ability to work in a fast-paced environment with a strong delivery focus and strong organizational skills.
Bachelor's degree in Computer Science, Cybersecurity, Business and Technology Management, Finance, Data Science, or a related discipline.

Nice To Haves

Project management experience.
Proficiency in SQL, graph databases, and Tableau.
Relevant certifications such as CISA, CISM, CBCP/MBCI, CTPRP, or related AI/ML, data, and resilience certifications.

Responsibilities

Identify, monitor, and analyze operational risks related to AI system resilience, including infrastructure or model outages, non-deterministic behavior under stress, cascading multi-agent failures, model degradation from data drift, and unavailability of third-party hosted LLMs and MCP server ecosystems.
Ensure AI systems that qualify as dependent or Integral Assets to Important Business Services are mapped in Business Continuity Plans, subject to Impact Tolerance Statements, and supported by alternate workarounds such as model fallback or alternate vendors.
Promote resilience-by-design principles and challenge gaps in controls such as AI Model Version Pinning, AI System Observability, multi-data-center deployment, and circuit-breaker or fallback procedures.
Conduct evidence-based scenario analysis and support integrated or asset-based testing of AI-dependent Important Business Services, coordinating with first-line Engineering, TPRM, and business stakeholders to confirm disruption remains within impact tolerances, including RTO, RPO, and SLA requirements.
Identify, monitor, and analyze risks from third-party AI services, externally hosted LLMs, and vendor-supplied foundation models, including information leakage, model tampering, MCP server supply-chain compromise, and agent-mediated credential harvesting.
Oversee vendor due diligence, third-party model validation, and SLA enforcement for AI safety, performance, and Denial-of-Wallet monitoring; escalate contractual breaches.
Monitor the AI third-party control inventory for sufficiency and completeness, including AI Data Leakage Prevention, MCP Server Security Governance, and Agentic System Credential Protection Framework controls.
Apply the Firmwide Policy and Standard for Data Governance to AI use cases, ensuring datasets used to train, fine-tune, ground, or operate AI and agentic systems are inventoried, risk-tiered, and assigned Owners, Secondary Owners, and Senior Owners.
Challenge the adequacy of data quality controls and data lineage documentation for datasets feeding AI model pipelines, particularly across divisional boundaries or where Data Contracts are absent.
Assess whether Authoritative Data Sources used by AI/ML systems meet governed-access, reconciliation, and change-management requirements; escalate reliance on non-authoritative or ungoverned data sources as Data Defects or exceptions.
Review AI-related Data Defects and Data Requests for appropriate logging, remediation, and escalation under the Firmwide Standard for Data Defect and Data Request Management.
Analyze trends in AI availability, observability telemetry, vendor performance, and data quality metrics, and escalate concerns to senior management when warranted.
Facilitate Operational Risk Event reporting for AI resilience, third-party, and data-related incidents.
Contribute to divisional risk profile assessments, RCSA review and challenge, and New Activity reviews for AI model deployments, vendor engagements, and data sourcing changes.
Remain current on regulatory and industry developments affecting AI resilience, third-party risk, and data governance obligations.
Identify and drive initiatives to improve AI risk management practices across resilience, third-party, and data domains.