Technology Risk - Security Architecture - Vice President (New York)

WHO WE ARE

Led by the Chief Information Security Officer (CISO), Technology Risk secures Goldman Sachs against hackers and other cyber threats. We are responsible for detecting and preventing attempted cyber intrusions against the firm, helping the firm develop more secure applications and infrastructure, developing software in support of our efforts, measuring cybersecurity risk, and designing and driving implementation of cybersecurity controls. The team has global presence across the Americas, APAC, India and EMEA.

Within Technology Risk, Advisory is the consultative and technology subject matter expertise arm, responsible for assessing new technology initiatives for risk, partnering with engineers to architect and design secure products and services, embedding implementation reviews as part of the SDLC and CI/CD pipeline via code analysis and penetration testing, and guiding technology innovation in terms of security and control across Goldman Sachs. The team plays a critical role in designing and assessing controls for our transition to building native public cloud applications.

Goldman Sachs has one of the most progressive Technology Risk teams in the industry and is continuing to push the development of risk in preference to security within technology and the business. Year on year success has led the team to work deeper into the organization and gain valuable insights into how technology needs to function, what its risk really is and how this impacts the business.

Role

We are seeking a Third-Party Security Architect Vice President to establish and drive technical deep-dive evaluations of critical and high-risk third-party suppliers. This role goes beyond the traditional vendor risk oversight processes and requires a hands-on cybersecurity architect capable of interrogating complex architecture blueprints, conducting technical design reviews, identifying subtle structural vulnerabilities, and challenging supplier engineering teams on implementation details that present cybersecurity risk.

The ideal candidate must be able to evaluate supplier systems across the modern technology landscape-ranging from containerized multi-cloud infrastructures to Large Language Model (LLM) pipelines and blockchain architectures-to guarantee that integrations and external dependencies meet enterprise-grade resilience and zero-trust standards. They must possess demonstrated ability to read, evaluate, and challenge complex system architecture diagrams, sequence diagrams, and cloud topology maps and be able to distill cyber risks for executive stakeholders.

RESPONSIBILITIES AND QUALIFICATIONS

Job Responsibilities: Support the Technology Risk Advisory function by helping to shape the Vendor Technology Risk strategy, assessing cybersecurity risk for the Firm's most critical suppliers and working with Business Units to manage cyber risk portfolios.

Basic Qualifications:

• Conduct rigorous technical architecture reviews of third-party supplier platforms, data flows, and infrastructure designs prior to onboarding and during periodic recertifications
• Dissect system architecture diagrams, network topologies, API integration patterns, and data boundary configurations to pinpoint single points of failure, insecure configurations, and architectural anti-patterns.
• Apply threat modeling frameworks (such as STRIDE) to supplier solutions, assessing systemic threats across external dependencies and trust boundaries.
• Assess cyber risk across technologies such as
  • Artificial Intelligence & Machine Learning (AI/ML): Evaluate suppliers leveraging Generative AI, LLMs, and automated inference engines. Assess prompt injection defenses, Retrieval-Augmented Generation (RAG) data leakage vectors, training data provenance, model weight protections, and fine-tuning isolation
  • Cloud Architecture & Microservices: Interrogate public cloud (AWS, Azure, GCP) environments for multi-tenancy isolation, container orchestration security (Kubernetes), serverless configurations, egress controls, and infrastructure-as-code (IaC) governance
  • Distributed Ledger & Blockchain: Review decentralized infrastructure, smart contract integrity, key custody models, consensus mechanisms, and private key handling where blockchain or tokenized solutions are proposed.
• Deep understanding of core cybersecurity domains including:
  • Identity, Entitlement, & Access Governance: Review Identity and Access Management (IAM), Privileged Access Management (PAM), Federation/SSO (SAML, OIDC), credential vaults, service account scoping, and Multi-Factor Authentication (MFA) enforcement.
  • Application Security: Scrutinize vendor Secure Software Development Life Cycle (SDLC) practices, continuous integration and deployment (CI/CD) pipeline controls, software supply chain defenses (SBOMs, dependency signing), and secret management.
  • Data Protection & DLP: Validate cryptographic standards for data at rest and data in transit (TLS cipher suites, envelope encryption, customer-managed encryption keys / BYOK, HSMs), alongside tokenization, masking, and Data Loss Prevention (DLP) controls.
  • Offensive Security Validation: Review supplier penetration testing reports, red team results, and vulnerability disclosure programs. Interrogate exploit chains, evaluate risk remediation timelines, and verify that findings were resolved fundamentally rather than superficially masked.
• Ability to translate complex architectural risks and exploitation scenarios into tangible operational and financial risk analyses for internal business owners and senior leadership
• Ability to define and negotiate contractual technical security schedules and minimum architectural baseline requirements for strategic procurement initiatives
• Minimum of 8-10+ years in technical cybersecurity roles, with significant hands-on experience in Security Architecture, Cloud Security Engineering, Application Security, or Technical Threat Modeling
• Bachelor's or master's degree in computer science, Computer Engineering, Cybersecurity, or equivalent practical industry experience

Preferred qualifications:

• Prior experience leading technical security assessments within financial services, critical infrastructure, defense, or tier-1 SaaS environments.
• Hands-on programming/scripting proficiency (Python, Go, Java, or Bash) to understand codebase structures and review automated pipelines
• One or more of the following Certificates; CISSP, CCSP, GSEC, CEH, CCNA, CCNP, Solution Architect, Security+, SSCP, or CASP+, AWS Certified Security - Specialty, Microsoft Certified: Cybersecurity Architect Expert

Salary Range

The expected base salary for this New York, NY, United States-based position is $130000-$250000. In addition, you may be eligible for a discretionary bonus if you are an active employee as of fiscal year-end.