Internal Audit - Foundation Engineering / Tech Risk and Cybersecurity, Associate

About the role

Goldman Sachs Internal Audit is looking for an Associate in its Foundation Engineering / Tech Risk and Cybersecurity team in Singapore. As part of the third line of defense, the team assesses technology and cybersecurity risks and controls across the firm's technology environment, including infrastructure, cloud platforms, identity and access management, network and platform security, vulnerability and configuration management, data protection, resilience and emerging technologies.

Key responsibilities

• Take part in scoping, planning and executing technology and cybersecurity audits, identifying key risks and determining audit testing.
• Understand technology processes, architectures and controls and assess their design and operating effectiveness.
• Perform audit testing using technical evidence, data analysis, system configurations, documentation and discussions with engineering and technology stakeholders.
• Identify control gaps and articulate the associated technology, cybersecurity and business risks.
• Discuss findings with local and global technology management and contribute to audit reports and communications.
• Follow up on management's remediation of audit findings and collaborate with global audit teams on cross-region coverage.
• Stay aware of cybersecurity, cloud, infrastructure and emerging technology developments, and of regulatory and industry expectations, including those in the APAC region.

Required profile

• Minimum 4 years of experience in technology audit, cybersecurity audit, technology risk, information security, engineering risk or a related field.
• Degree in Computer Science, Information Security, Cybersecurity, Engineering, Information Systems or a related discipline.
• Experience auditing or risk-assessing cloud environments, technology infrastructure, engineering platforms or cybersecurity capabilities.
• Ability to understand technical architectures and translate them into risks, controls and audit procedures.
• Strong analytical, problem-solving, written and verbal communication skills, and ability to work across global teams.

Required skills

• Cloud and infrastructure technologies such as AWS, Microsoft Azure or Google Cloud, and containers and Kubernetes.
• Familiarity with frameworks such as NIST Cybersecurity Framework, NIST 800-53, CIS Controls and ISO/IEC 27001.
• APAC technology and cybersecurity regulatory expectations; knowledge of Singapore requirements is advantageous.
• Certifications such as CISA, CISSP, CISM, CRISC or CCSP, and data analytics or scripting for audits, are a plus.