Tech Risk – Global Cyber Defense & Intelligence – Bug Bounty – Associate

WHO WE ARE

Led by the Chief Information Security Officer (CISO), Technology Risk secures Goldman Sachs against hackers and other cyber threats. We are responsible for detecting and preventing attempted cyber intrusions against the firm, helping the firm develop more secure applications and infrastructure, developing software in support of our efforts, measuring cybersecurity risk, and designing and driving implementation of cybersecurity controls. The team has global presence across the Americas, APAC, India and EMEA.

Within Technology Risk, the Global Cyber Defense & Intelligence (GCDI) identifies malicious activity, manage the lifecycle of vulnerabilities within GS technologies, and investigates and manages threats across the firm. We are a team of security, software, and product engineers that allow the firm to respond appropriately to firm risks through the use of detection models, security architecture, and cutting-edge cyber threat analysis to manage internal and external threats against the firm. The Bug Bounty team within GCDI performs one of the most important security and risk functions at the firm – working with external security researchers to detect vulnerabilities in our technology and ensuring their remediation before they can be exploited by malicious hackers.

The Goldman Sachs has one of the most progressive Technology Risk teams in the industry and is continuing to push the development of risk in preference to security within technology and the business. Year on year success has led the team to work deeper into the organization and gain valuable insights into how technology needs to function, what its risk really is and how this impacts the business.

YOUR IMPACT

You will be a key addition to the Bug Bounty team, which continuously strives to contribute immensely to the improvement of the overall security posture of the organization. This role will offer you a great platform to apply your knowledge and skills as well as opportunity to engage with key stakeholders within the organization to consistently improve the program through various functions such as vulnerability discovery, risk assessment, tracking and reporting.

HOW YOU WILL FULFILL YOUR POTENTIAL

In this role, you will be a part of the Bug Bounty team operating one of the top Bug Bounty programs in the industry, and you will be directly responsible for driving various activities to ensure the successful detection, review, and remediation of vulnerabilities. This includes applying your analytical, reasoning & specialized technical security expertise to investigate, isolate and track network and security vulnerabilities, false positive identification, and engagement with various teams for remediation process. This role will also give you the opportunity to work with and learn from some of the best security researchers around the world.

The ideal candidate should have strong technical experience performing penetration tests and vulnerability assessments across application and network targets for large enterprises. The candidate will also have deep expertise in understanding root causes of vulnerabilities, triaging and guiding, driving remediation of vulnerabilities.

Responsibilities

• Execute and support the firm’s global Bug Bounty program as part of the team within Technology Risk.
• Triage vulnerability reports submitted to our Bug Bounty program – includes tracking and responding to submissions, reproducing and chaining vulnerabilities, coordinating with teams to triage and resolve issues, and providing feedback to security researchers.
• Assess vulnerability impact, risk, and escalate possible security incidents.
• Work directly with project teams to help them understand the risk of vulnerabilities and provide remediation guidance.
• Collaborate extensively with the firm’s engineering teams and adjacent advisory and vulnerability management teams to track remediation timelines and ensure vulnerabilities fixes are scheduled and implemented in a timely manner.
• Develop tooling to help automate vulnerability discovery and scanning for issues at scale.
• Leverage learnings from the program to identify vulnerabilities in software applications and software designing processes to reduce security risks.
• Share learnings from the bug bounty program with adjacent security teams within the Firm as needed.
• Stay up to date with new technologies and assist engineers in assessing risk.
• Enable a world-class cyber defense program by working closely with other technical, incident management, and forensic personnel to develop a fuller understanding of activity of cyber threat actors.

Basic Qualifications

• At least 2+ years of hands-on application, infrastructure, or cloud security experience, including penetration testing, application/network assessments and risk assessments.
• Strong practical understanding of web, network, and mobile application security vulnerabilities such as OWASP Top 10
• Experience conducting root cause analysis of vulnerabilities and determining feasible technical solutions
• Experience using industry standard vulnerability assessment and management tools and interpreting, analyzing and assessing their data output.
• Clear communication skills, both verbal and in writing, including the ability to clearly articulate technical vulnerabilities and associated risks to both technical and non-technical audiences
• Experience working within a vulnerability management or related program in a complex and diverse global environment.
• A passion for, and deep understanding of, the technical aspects of information security with particular focus on vulnerability and threat management

Preferred Experience/Qualifications

• Prior experience managing Bug Bounty programs or significant experience hunting on Bug Bounty programs.
• Bachelor’s degree or higher in Computer Science, Information Systems, Cyber Security or a related field is preferred.
• CEH, OSCP or equivalent certification
• Working knowledge/experience with programming, scripting to help develop bulk scanning tools
• Experience working as part of a global team

#TechRiskCybersecurity