Tech Risk Global Cyber Defense & Intelligence Application Security Engineer Bug Bounty Associate

About the position

Led by the Chief Information Security Officer (CISO), Technology Risk secures Goldman Sachs against hackers and other cyber threats. We are responsible for detecting and preventing attempted cyber intrusions against the firm, helping the firm develop more secure applications and infrastructure, developing software in support of our efforts, measuring cybersecurity risk, and designing and driving implementation of cybersecurity controls. The team has global presence across the Americas, APAC, India and EMEA. Within Technology Risk, the Global Cyber Defense & Intelligence (GCDI) identifies malicious activity, manage the lifecycle of vulnerabilities within GS technologies, and investigates and manages threats across the firm. We are a team of security, software, and product engineers that allow the firm to respond appropriately to firm risks through the use of detection models, security architecture, and cutting-edge cyber threat analysis to manage internal and external threats against the firm. The Bug Bounty team within GCDI performs one of the most important security and risk functions at the firm - working with external security researchers to detect vulnerabilities in our technology and ensuring their remediation before they can be exploited by malicious hackers. The Goldman Sachs has one of the most progressive Technology Risk teams in the industry and is continuing to push the development of risk in preference to security within technology and the business. Year on year success has led the team to work deeper into the organization and gain valuable insights into how technology needs to function, what its risk really is and how this impacts the business.

Responsibilities

• Execute and support the firm's global Bug Bounty program as part of the team within Technology Risk.
• Triage vulnerability reports submitted to our Bug Bounty program - includes tracking and responding to submissions, reproducing and chaining vulnerabilities, coordinating with teams to triage and resolve issues, and providing feedback to security researchers.
• Assess vulnerability impact, risk, and escalate possible security incidents.
• Work directly with project teams to help them understand the risk of vulnerabilities and provide remediation guidance.
• Collaborate extensively with the firm's engineering teams and adjacent advisory and vulnerability management teams to track remediation timelines and ensure vulnerabilities fixes are scheduled and implemented in a timely manner.
• Develop tooling to help automate vulnerability discovery and scanning for issues at scale.
• Leverage learnings from the program to identify vulnerabilities in software applications and software designing processes to reduce security risks.
• Share learnings from the bug bounty program with adjacent security teams within the Firm as needed.
• Stay up to date with new technologies and assist engineers in assessing risk.
• Enable a world-class cyber defense program by working closely with other technical, incident management, and forensic personnel to develop a fuller understanding of activity of cyber threat actors.

Requirements

• At least 2 years of hands-on application, infrastructure, or cloud security experience, including penetration testing, application/network assessments and risk assessments.
• Strong practical understanding of web, network, and mobile application security vulnerabilities such as OWASP Top 10.
• Experience conducting root cause analysis of vulnerabilities and determining feasible technical solutions.
• Experience using industry standard vulnerability assessment and management tools and interpreting, analyzing and assessing their data output.
• Clear communication skills, both verbal and in writing, including the ability to clearly articulate technical vulnerabilities and associated risks to both technical and non-technical audiences.
• Experience working within a vulnerability management or related program in a complex and diverse global environment.
• A passion for, and deep understanding of, the technical aspects of information security with particular focus on vulnerability and threat management.

Nice-to-haves

• Prior experience managing or hunting on Bug Bounty programs.
• Bachelor's degree or higher in Computer Science, Information Systems, Cyber Security or a related field is preferred.
• CEH, OSCP or equivalent certification.
• Working knowledge/experience with programming, scripting to help develop bulk scanning tools.
• Experience working as part of a global team.