Secure SDLC Associate - Dallas - Technology Risk

Goldman Sachs; Dallas (TX); On-site; USD 120,000 - 180,000; Full time

Job summary

Goldman Sachs is seeking a Security Engineer in Technology Risk focused on Secure SDLC to empower developers with secure coding practices and modern tooling. You will lead static and dynamic analysis initiatives, evaluate AI-augmented capabilities, and integrate embedded application security controls across the SDLC.

You will collaborate with business units to remediate issues, design scalable security solutions, and stay ahead of emerging technologies and regulatory requirements.

Qualifications

• Master's degree in Computer Science, Computer Engineering, Information Security, or a related field with at least one year of related experience.
• Bachelor's degree in Computer Science, Computer Engineering, Information Security, or a related field with at least three years of related experience.
• Strong knowledge of Secure SDLC principles and security controls across development stages.
• Experience with SAST, DAST, IaC security and security tooling within a cloud/on-premise environment.
• Familiarity with OWASP Top 10, CWE and threat modeling.

Responsibilities

• Lead and support static and dynamic analysis initiatives across the Secure SDLC.
• Evaluate and adopt AI-augmented security capabilities within Secure SDLC services.
• Drive integration of embedded security controls within SDLC ecosystem.
• Collaborate with Business Units to remediate issues identified by automated tools.
• Design, implement and maintain secure SDLC solutions across global businesses.

Skills

Threat modeling

SDLC security

AI security awareness

Security testing

Shift-left security

Vulnerability assessment

Education

Master's degree in CS/CE/InfoSec

Bachelor's degree in CS/CE/InfoSec

Tools

SAST

DAST

IaC security

Control Gating

Security tooling integration

Job description

Job DescriptionGoldman Sachs Technology Risk leads threat and risk management initiatives that help protect the firm and our clients from information and cyber security risks. Our team equips the firm with the knowledge and tools to measure risk, identify and mitigate threats and potential risks, and prevent the introduction of antipatterns into the firm's technology stack.

Job DescriptionGoldman Sachs Technology Risk leads threat and risk management initiatives that help protect the firm and our clients from information and cyber security risks. Our team equips the firm with the knowledge and tools to measure risk, identify and mitigate threats and potential risks, and prevent the introduction of antipatterns into the firm's technology stack. Specifically, the Technology Risk Secure SDLC team is accountable for enabling developers across the firm to build secure technology solutions and platforms that hold up to the highest development security practices and standards. You will join a progressive team that continues to push the development of security controls within engineering functions and across the business, interact with all parts of the firm, and gain experience and knowledge that will facilitate your career growth and make an impact on various initiatives across the firm.

Job Duties

• Lead and support the implementation of static and dynamic analysis, as well as security awareness initiatives across all stages of the Secure Software Development Lifecycle (Secure SDLC).
• Support the evaluation and adoption of AI-augmented capabilities within Secure SDLC services, including static and dynamic analysis tooling (SAST, DAST, IaC, Control Gating, etc.).
• Drive the integration and adoption of embedded application security controls within SDLC ecosystem.
• Interface with Business Units to help build secure applications and remediate issues identified by automated tools.
• Develop, enhance, support and maintain the Firm's Secure SDLC solutions in support of its global businesses.
• Design and implement high-quality, scalable and thoughtful technology solutions leveraging both internal and open-source services.
• Assist in requirements gathering, user experience refinement, development, testing (unit, integration and regression), User Acceptance Testing (UAT), Deployment, and Quality Assurance (QA).
• Work with internal teams to help develop secure solution designs.
• Identify new external technologies that can be used to transform our financial businesses and internal platforms in innovative and disruptive ways.
• Work in all phases of the Secure SDLC to meet internal and regulatory requirements.
• Design, implement and maintain robust testing suites to enable secure, complete, and scalable solutions across our business lines.
• Maintain awareness of emerging technologies (including but not limited to) agentic AI workflows and their potential application to Secure SDLC processes.

Minimum Education Requirements

• Master's degree (U.S. or foreign equivalent) in Computer Science, Computer Engineering, Information Security, or a related field and one (1) year of experience in the job offered or a related role.
• Bachelor's degree (U.S. or foreign equivalent) in Computer Science, Computer Engineering, Information Security, or a related field and three (3) years of experience in the job offered or a related role.

OR

• Bachelor's degree (U.S. or foreign equivalent) in Computer Science, Computer Engineering, Information Security, or a related field and three (3) years of experience in the job offered or a related role.

Special Skills And/or Licenses Required To Perform The Job

• Prior experience should include one (1) year (with a Master\'s degree) or three (3) years (with a Bachelor\'s degree) with:
• Application and infrastructure architecture and security (on premise and Cloud).
• Application security best practices including OWASP Top 10, OWASP LLM Top 10, and CWE.
• Application security vulnerabilities and controls to remediate risks.
• Assessing and mitigating software security threat vectors, threat modeling, attack surface analysis, security design reviews, source code reviews, penetration testing or vulnerability assessments.
• Working in shift left environment to help embed security in Design phase to implement security controls within system architecture.
• Conducting infrastructure or application security risk assessments.
• Foundational understanding of Large Language Model (LLM) behaviors, including common strengths and weaknesses (e.g., hallucination, behavior inconsistency, context limitations, reproducibility and verification, etc.).
• General familiarity with agentic AI workflows and their role in software development and security tooling.