WHO WE ARE

Led by the Chief Information Security Officer (CISO), Technology Risk secures Goldman Sachs against hackers and other cyber threats. We are responsible for detecting and preventing attempted cyber intrusions against the firm, helping the firm develop more secure applications and infrastructure, developing software in support of our efforts, measuring cybersecurity risk, and designing and driving implementation of cybersecurity controls. The team has global presence across the Americas, APAC, India and EMEA.

Within Technology Risk, Advisory is the consultative and technology subject matter expertise arm, responsible for assessing new technology initiatives for risk, partnering with engineers to architect and design secure products and services, embedding implementation reviews as part of the SDLC and CI/CD pipeline via code analysis and penetration testing, and guiding technology innovation in terms of security and control across Goldman Sachs. The team plays a critical role in designing and assessing controls for our transition to building native public cloud applications. We are looking for a candidate to focus on mobile security engineering for applications developed by Goldman Sachs, used by Goldman Sachs Employees and the security of mobile products.

YOUR IMPACT

You will be a key addition to the Technology Risk Advisory Mobile Security team, which ensures Mobile Applications delivered to our customers are secure and data is protected. In addition, the Mobile Security Team focuses on the evaluation of products used to process GS data throughout the BYOD ecosystem and advises on all aspects of Mobile Device Security.

HOW YOU WILL FULFILL YOUR POTENTIAL

Your responsibilities will include conducting design reviews, penetration testing and advising on the security of our customer facing mobile applications. You will promote the use of secure coding and design for mobile applications. You will also advise on the use of mobile applications to process GS Data throughout the Goldman Sachs BYOD ecosystems and where appropriate on behalf of our customers. This will be an opportunity to advise on flagship mobile applications throughout the whole SDLC and develop your mobile security skills and remain on the cutting edge of a dynamic and challenging threat landscape.

Responsibilities include:

Performing mobile application design reviews and advising on secure development Serve as a subject matter expert for mobile application developers and architects Conduct pen-tests against mobile apps, including reviewing security assessment reports from external pen-tests  Conduct Debrief Calls with the business to articulate risk and recommend a mitigation strategy Develop secure mobile architecture design policy Mentor other junior members of the team

Basic Qualifications:

5+ years’ experience in one or more technical roles (focused in mobile security) Prior experience in performing Threat Modelling or Secure Design Reviews Knowledge of most common Mobile Application Security vulnerabilities – ., OWASP Top 10  Familiarity with Security standards such as OWASP MASVS, NIST and Sans top 20 Experience in mobile application vulnerability assessments and penetration testing of mobile applications  Working knowledge of application security tools such as those used for Jailbreak/Rooting and testing of iOS/Android applications  Ability to identify threats, abuse cases, and gaps in the design before it is implemented Strong written and oral communication skills to be able to articulate risks to both technical and management stakeholders

Preferred qualifications:

In-depth knowledge of the Android Operating system Experience of Secure Systems Development Lifecycle for Mobile Applications Experience in using mobile application testing tools such as Magisk, Frida, Burp, Hopper Disassembler, etc. Also, crafting custom proof of concept application exploits using testing tools/frameworks or scripting exploits in Python, Perl, JS, Shell scripting, etc.  Experience in Mobile Application Management (MAM) or Mobile Device Management (MDM) solutions Knowledge of network, application and operating system security risks. MS. in Computer Science, System/Computer Engineering, Cyber-Security, or Information Security.  Experience or trainings in related disciplines . computer science, computer security, software development, system design, open source frameworks, encryption schemes, etc.

#TechRiskCybersecurity

ABOUT GOLDMAN SACHS

At Goldman Sachs, we commit our people, capital, and ideas to help our clients, shareholders, and the communities we serve to grow. Founded in 1869, we are a leading global investment banking, securities, and investment management firm. Headquartered in New York, we maintain offices around the world. 

We believe who you are makes you better at what you do. We're committed to fostering and advancing diversity and inclusion in our own workplace and beyond by ensuring every individual within our firm has a number of opportunities to grow professionally and personally, from our training and development opportunities and firmwide networks to benefits, wellness and personal finance offerings and mindfulness programs. Learn more about our culture, benefits, and people at . 

We’re committed to finding reasonable accommodations for candidates with special needs or disabilities during our recruiting process.