【ゴールドマン・サックス】Risk, APAC Cyber & Technology Operational Risk Technical Coverage, Vice President, Tokyo
仕事内容
At Goldman Sachs, we connect people, capital and ideas to help solve problems for our clients. We are a leading global financial services firm providing investment banking, securities and investment management services to a substantial and diversified client base that includes corporations, financial institutions, governments and individuals.
About the Role
The Operational Risk Department is an independent risk management function responsible for developing and implementing a standardized framework to identify, measure, monitor, and assess operational risk across the firm.
This role will provide technically credible, independent second-line-of-defense oversight and challenge of cyber and technology operational risk across APAC. The individual will operate as a regional technical coverage resource across the full Cyber & Technology Operational Risk portfolio, supporting priorities led by the team's oversight leads for technology infrastructure and assets, security operations and identity, technology change and resilience, insider threat, data security, and vulnerability and patch management.
The successful candidate will combine broad engineering and cybersecurity knowledge with strong risk judgment. The role requires the ability to move between detailed technical evidence and senior-level risk conclusions, partner with regional and global stakeholders, and support multiple coverage teams as risks, regulatory priorities, incidents, assessments, and change initiatives evolve.
応募資格(必須経験など)
Qualifications
• 7+ years of relevant experience in technology engineering, cybersecurity, technology risk, operational resilience, operational risk, internal audit, controls assurance, or a related discipline within a complex organization.
• Broad technical knowledge across infrastructure, cloud, networking, identity, cybersecurity operations, software delivery, technology resilience, data security, vulnerability management, and technology asset management, with depth in at least two of these areas.
• Ability to review technical architectures, data flows, service dependencies, control designs, engineering standards, telemetry, inventories, metrics, test results, incidents, and remediation evidence and translate them into clear risk conclusions.
• Experience assessing control design and operating effectiveness and performing risk assessments, maturity assessments, thematic reviews, issue validation, or evidence-based assurance activities.
• Working knowledge of public cloud and modern engineering patterns, including containers, orchestration, infrastructure as code, CI/CD, APIs, distributed services, observability, secrets management, and third-party technology dependencies.
• Knowledge of security and technology risk frameworks and guidance such as NIST Cybersecurity Framework, NIST SP 800-53, ISO 27001, COBIT, FFIEC, CIS Controls, and Cloud Security Alliance Cloud Controls Matrix.
• Familiarity with APAC regulatory expectations relating to technology risk, cybersecurity, operational resilience, outsourcing, cloud, data protection, and incident reporting. Direct experience working with one or more APAC regulators is beneficial.
• Strong analytical capability, including the ability to work with structured and unstructured data to identify anomalies, trends, dependencies, control gaps, and systemic risk. Experience with SQL, Python, data visualization, graph analysis, or similar tools is beneficial.
• Strong business judgment and the ability to connect technical risk to critical business services, client and market impact, legal entities, operational resilience, and the firm's risk appetite.
• Clear written and verbal communication skills, with the ability to explain complex technical matters to non-technical stakeholders, present with impact, and influence senior engineering and risk leaders.
• Ability to manage multiple priorities, operate independently across time zones, respond effectively to incidents and regulatory requests, and deliver high-quality work in a fast-paced environment.
• Relevant certifications such as CISSP, CISA, CISM, CRISC, CCSP, cloud platform certifications, GIAC, CBCP/MBCI, network certifications, or similar credentials are beneficial.
• BA or BS degree in Computer Science, Engineering, Information Systems, Cybersecurity, Data Science, Business, or a related discipline, or equivalent practical experience.