Tech Risk – Advisory – Mobile Security Engineer – VP/Associate
London, Greater London, England, United Kingdom
Goldman Sachs
The Goldman Sachs Group, Inc. is a leading global investment banking, securities and investment management firm that provides a wide range of financial services to a substantial and diversified client base.WHO WE ARE
Led by the Chief Information Security Officer (CISO), Technology Risk secures Goldman Sachs against hackers and other cyber threats. We are responsible for detecting and preventing attempted cyber intrusions against the firm, helping the firm develop more secure applications and infrastructure, developing software in support of our efforts, measuring cybersecurity risk, and designing and driving implementation of cybersecurity controls. The team has global presence across the Americas, APAC, India and EMEA.
Within Technology Risk, Advisory is the consultative and technology subject matter expertise arm, responsible for assessing new technology initiatives for risk, partnering with engineers to architect and design secure products and services, embedding implementation reviews as part of the SDLC and CI/CD pipeline via code analysis and penetration testing, and guiding technology innovation in terms of security and control across Goldman Sachs. The team plays a critical role in designing and assessing controls for our transition to building native public cloud applications. We are looking for a candidate to focus on mobile security engineering for applications developed by Goldman Sachs, used by Goldman Sachs Employees and the security of mobile products.
YOUR IMPACT
You will be a key addition to the Technology Risk Advisory Mobile Security team, which ensures Mobile Applications delivered to our customers are secure and data is protected. In addition, the Mobile Security Team focuses on the evaluation of products used to process GS data throughout the BYOD ecosystem and advises on all aspects of Mobile Device Security.
HOW YOU WILL FULFILL YOUR POTENTIAL
Your responsibilities will include conducting design reviews, penetration testing and advising on the security of our customer facing mobile applications. You will promote the use of secure coding and design for mobile applications. You will also advise on the use of mobile applications to process GS Data throughout the Goldman Sachs BYOD ecosystems and where appropriate on behalf of our customers. This will be an opportunity to advise on flagship mobile applications throughout the whole SDLC and develop your mobile security skills and remain on the cutting edge of a dynamic and challenging threat landscape.
Responsibilities include:
- Performing mobile application design reviews and advising on secure development
- Serve as a subject matter expert for mobile application developers and architects
- Conduct pen-tests against mobile apps, including reviewing security assessment reports from external pen-tests
- Conduct Debrief Calls with the business to articulate risk and recommend a mitigation strategy
- Develop secure mobile architecture design policy
- Mentor other junior members of the team
Basic Qualifications:
- 5+ years’ experience in one or more technical roles (focused in mobile security)
- Prior experience in performing Threat Modelling or Secure Design Reviews
- Knowledge of most common Mobile Application Security vulnerabilities – e.g., OWASP Top 10
- Familiarity with Security standards such as OWASP MASVS, NIST and Sans top 20
- Experience in mobile application vulnerability assessments and penetration testing of mobile applications
- Working knowledge of application security tools such as those used for Jailbreak/Rooting and testing of iOS/Android applications
- Ability to identify threats, abuse cases, and gaps in the design before it is implemented
- Strong written and oral communication skills to be able to articulate risks to both technical and management stakeholders
Preferred qualifications:
- In-depth knowledge of the Android Operating system
- Experience of Secure Systems Development Lifecycle for Mobile Applications
- Experience in using mobile application testing tools such as Magisk, Frida, Burp, Hopper Disassembler, etc. Also, crafting custom proof of concept application exploits using testing tools/frameworks or scripting exploits in Python, Perl, JS, Shell scripting, etc.
- Experience in Mobile Application Management (MAM) or Mobile Device Management (MDM) solutions
- Knowledge of network, application and operating system security risks.
- MS. in Computer Science, System/Computer Engineering, Cyber-Security, or Information Security.
- Experience or trainings in related disciplines e.g. computer science, computer security, software development, system design, open source frameworks, encryption schemes, etc.
#TechRiskCybersecurity
ABOUT GOLDMAN SACHS
At Goldman Sachs, we commit our people, capital, and ideas to help our clients, shareholders, and the communities we serve to grow. Founded in 1869, we are a leading global investment banking, securities, and investment management firm. Headquartered in New York, we maintain offices around the world.
We believe who you are makes you better at what you do. We're committed to fostering and advancing diversity and inclusion in our own workplace and beyond by ensuring every individual within our firm has a number of opportunities to grow professionally and personally, from our training and development opportunities and firmwide networks to benefits, wellness and personal finance offerings and mindfulness programs. Learn more about our culture, benefits, and people at GS.com/careers.
We’re committed to finding reasonable accommodations for candidates with special needs or disabilities during our recruiting process. Learn more: https://www.goldmansachs.com/careers/footer/disability-statement.html
© The Goldman Sachs Group, Inc., 2024. All rights reserved.
Goldman Sachs is an equal employment/affirmative action employer Female/Minority/Disability/Veteran/Sexual Orientation/Gender Identity
* Salary range is an estimate based on our InfoSec / Cybersecurity Salary Index 💰
Tags: Android Application security Banking CI/CD CISO Cloud Code analysis Computer Science Encryption Exploits Finance iOS Mobile security NIST Open Source OWASP Pentesting Perl Python SANS Scripting SDLC Security assessment Security Assessment Report Strategy Vulnerabilities
Perks/benefits: Career development Wellness
More jobs like this
Explore more InfoSec / Cybersecurity career opportunities
Find even more open roles in Ethical Hacking, Pen Testing, Security Engineering, Threat Research, Vulnerability Management, Cryptography, Digital Forensics and Cyber Security in general - ordered by popularity of job title or skills, toolset and products used - below.
- Open Senior Product Security Engineer jobs
- Open Information Systems Security Officer (ISSO) jobs
- Open Information Security Specialist jobs
- Open Senior Cyber Security Engineer jobs
- Open Ethical hacker / Pentester H/F jobs
- Open Cyber Security Architect jobs
- Open Cyber Security Specialist jobs
- Open Product Security Engineer jobs
- Open Cybersecurity Analyst jobs
- Open Chief Information Security Officer jobs
- Open Security Specialist jobs
- Open Staff Security Engineer jobs
- Open Manager Pentest H/F jobs
- Open Senior Information Security Analyst jobs
- Open Consultant infrastructure sécurité H/F jobs
- Open Consultant SOC / CERT H/F jobs
- Open IT Security Analyst jobs
- Open Senior Information Security Engineer jobs
- Open Cybersecurity Consultant jobs
- Open Senior Penetration Tester jobs
- Open IT Security Engineer jobs
- Open Security Operations Analyst jobs
- Open Cybersecurity Specialist jobs
- Open Sr. Security Engineer jobs
- Open Security Consultant jobs
- Open CISM-related jobs
- Open Windows-related jobs
- Open Network security-related jobs
- Open Pentesting-related jobs
- Open Agile-related jobs
- Open Application security-related jobs
- Open GCP-related jobs
- Open Vulnerability management-related jobs
- Open ISO 27001-related jobs
- Open Threat intelligence-related jobs
- Open CISA-related jobs
- Open Analytics-related jobs
- Open IAM-related jobs
- Open Security assessment-related jobs
- Open Malware-related jobs
- Open Java-related jobs
- Open APIs-related jobs
- Open Security Clearance-related jobs
- Open Forensics-related jobs
- Open SaaS-related jobs
- Open CEH-related jobs
- Open EDR-related jobs
- Open DevOps-related jobs
- Open IDS-related jobs
- Open DoD-related jobs