Engineering -- Tech Risk -- Global Cyber Defense & Intelligence -- Bug Bounty -- Associate -- Dallas
Dallas, Texas, United States
Goldman Sachs
The Goldman Sachs Group, Inc. is a leading global investment banking, securities and investment management firm that provides a wide range of financial services to a substantial and diversified client base.Tech Risk – Global Cyber Defense & Intelligence – Bug Bounty – Associate
WHO WE ARE
Led by the Chief Information Security Officer (CISO), Technology Risk secures Goldman Sachs against hackers and other cyber threats. We are responsible for detecting and preventing attempted cyber intrusions against the firm, helping the firm develop more secure applications and infrastructure, developing software in support of our efforts, measuring cybersecurity risk, and designing and driving implementation of cybersecurity controls. The team has global presence across the Americas, APAC, India and EMEA.
Within Technology Risk, the Global Cyber Defense & Intelligence (GCDI) identifies malicious activity, manage the lifecycle of vulnerabilities within GS technologies, and investigates and manages threats across the firm. We are a team of security, software, and product engineers that allow the firm to respond appropriately to firm risks through the use of detection models, security architecture, and cutting-edge cyber threat analysis to manage internal and external threats against the firm. The Bug Bounty team within GCDI performs one of the most important security and risk functions at the firm – working with external security researchers to detect vulnerabilities in our technology and ensuring their remediation before they can be exploited by malicious hackers.
The Goldman Sachs has one of the most progressive Technology Risk teams in the industry and is continuing to push the development of risk in preference to security within technology and the business. Year on year success has led the team to work deeper into the organization and gain valuable insights into how technology needs to function, what its risk really is and how this impacts the business.
YOUR IMPACT
You will be a key addition to the Bug Bounty team, which continuously strives to contribute immensely to the improvement of the overall security posture of the organization. This role will offer you a great platform to apply your knowledge and skills as well as opportunity to engage with key stakeholders within the organization to consistently improve the program through various functions such as vulnerability discovery, risk assessment, tracking and reporting.
HOW YOU WILL FULFILL YOUR POTENTIAL
In this role, you will be a part of the Bug Bounty team operating one of the top Bug Bounty programs in the industry, and you will be directly responsible for driving various activities to ensure the successful detection, review, and remediation of vulnerabilities. This includes applying your analytical, reasoning & specialized technical security expertise to investigate, isolate and track network and security vulnerabilities, false positive identification, and engagement with various teams for remediation process. This role will also give you the opportunity to work with and learn from some of the best security researchers around the world.
The ideal candidate should have strong technical experience performing penetration tests and vulnerability assessments across application and network targets for large enterprises. The candidate will also have deep expertise in understanding root causes of vulnerabilities, triaging and guiding, driving remediation of vulnerabilities.
Responsibilities
- Execute and support the firm’s global Bug Bounty program as part of the team within Technology Risk.
- Triage vulnerability reports submitted to our Bug Bounty program – includes tracking and responding to submissions, reproducing and chaining vulnerabilities, coordinating with teams to triage and resolve issues, and providing feedback to security researchers.
- Assess vulnerability impact, risk, and escalate possible security incidents.
- Work directly with project teams to help them understand the risk of vulnerabilities and provide remediation guidance.
- Collaborate extensively with the firm’s engineering teams and adjacent advisory and vulnerability management teams to track remediation timelines and ensure vulnerabilities fixes are scheduled and implemented in a timely manner.
- Develop tooling to help automate vulnerability discovery and scanning for issues at scale.
- Leverage learnings from the program to identify vulnerabilities in software applications and software designing processes to reduce security risks.
- Share learnings from the bug bounty program with adjacent security teams within the Firm as needed.
- Stay up to date with new technologies and assist engineers in assessing risk.
- Enable a world-class cyber defense program by working closely with other technical, incident management, and forensic personnel to develop a fuller understanding of activity of cyber threat actors.
Basic Qualifications
- At least 2+ years of hands-on application, infrastructure, or cloud security experience, including penetration testing, application/network assessments and risk assessments.
- Strong practical understanding of web, network, and mobile application security vulnerabilities such as OWASP Top 10
- Experience conducting root cause analysis of vulnerabilities and determining feasible technical solutions
- Experience using industry standard vulnerability assessment and management tools and interpreting, analyzing and assessing their data output.
- Clear communication skills, both verbal and in writing, including the ability to clearly articulate technical vulnerabilities and associated risks to both technical and non-technical audiences
- Experience working within a vulnerability management or related program in a complex and diverse global environment.
- A passion for, and deep understanding of, the technical aspects of information security with particular focus on vulnerability and threat management
Preferred Experience/Qualifications
- Prior experience managing Bug Bounty programs or significant experience hunting on Bug Bounty programs.
- Bachelor’s degree or higher in Computer Science, Information Systems, Cyber Security or a related field is preferred.
- CEH, OSCP or equivalent certification
- Working knowledge/experience with programming, scripting to help develop bulk scanning tools
- Experience working as part of a global team
#TechRiskCybersecurity
ABOUT GOLDMAN SACHSAt Goldman Sachs, we commit our people, capital and ideas to help our clients, shareholders and the communities we serve to grow. Founded in 1869, we are a leading global investment banking, securities and investment management firm. Headquartered in New York, we maintain offices around the world.
We believe who you are makes you better at what you do. We're committed to fostering and advancing diversity and inclusion in our own workplace and beyond by ensuring every individual within our firm has a number of opportunities to grow professionally and personally, from our training and development opportunities and firmwide networks to benefits, wellness and personal finance offerings and mindfulness programs. Learn more about our culture, benefits, and people at GS.com/careers.
We’re committed to finding reasonable accommodations for candidates with special needs or disabilities during our recruiting process. Learn more: https://www.goldmansachs.com/careers/footer/disability-statement.html
© The Goldman Sachs Group, Inc., 2023. All rights reserved. Goldman Sachs is an equal employment/affirmative action employer Female/Minority/Disability/Veteran/Sexual Orientation/Gender Identity
* Salary range is an estimate based on our InfoSec / Cybersecurity Salary Index 💰
Tags: Application security Banking CEH CISO Cloud Computer Science Cyber defense Finance OSCP OWASP Pentesting Risk assessment Scripting Vulnerabilities Vulnerability management
Perks/benefits: Career development
More jobs like this
Explore more InfoSec / Cybersecurity career opportunities
Find even more open roles in Ethical Hacking, Pen Testing, Security Engineering, Threat Research, Vulnerability Management, Cryptography, Digital Forensics and Cyber Security in general - ordered by popularity of job title or skills, toolset and products used - below.
- Open Information Security Officer jobs
- Open Information Systems Security Officer (ISSO) jobs
- Open Information Security Specialist jobs
- Open Senior Cyber Security Engineer jobs
- Open Ethical hacker / Pentester H/F jobs
- Open Cyber Security Architect jobs
- Open Product Security Engineer jobs
- Open Cyber Security Specialist jobs
- Open Cybersecurity Analyst jobs
- Open Chief Information Security Officer jobs
- Open Manager Pentest H/F jobs
- Open Staff Security Engineer jobs
- Open Security Specialist jobs
- Open Senior Information Security Analyst jobs
- Open Consultant infrastructure sécurité H/F jobs
- Open IT Security Analyst jobs
- Open Cybersecurity Consultant jobs
- Open Consultant SOC / CERT H/F jobs
- Open Senior Information Security Engineer jobs
- Open Senior Penetration Tester jobs
- Open Security Operations Analyst jobs
- Open IT Security Engineer jobs
- Open Sr. Security Engineer jobs
- Open Cybersecurity Specialist jobs
- Open Security Researcher jobs
- Open CISM-related jobs
- Open Windows-related jobs
- Open Network security-related jobs
- Open Pentesting-related jobs
- Open Agile-related jobs
- Open Application security-related jobs
- Open ISO 27001-related jobs
- Open GCP-related jobs
- Open Vulnerability management-related jobs
- Open CISA-related jobs
- Open Analytics-related jobs
- Open Threat intelligence-related jobs
- Open IAM-related jobs
- Open Security assessment-related jobs
- Open Malware-related jobs
- Open APIs-related jobs
- Open SaaS-related jobs
- Open Java-related jobs
- Open Security Clearance-related jobs
- Open Forensics-related jobs
- Open CEH-related jobs
- Open IDS-related jobs
- Open EDR-related jobs
- Open DevOps-related jobs
- Open DoD-related jobs