Risk, APAC Cyber & Technology Operational Risk Technical Coverage, Vice President, Hong Kong/Singapore

Risk, APAC Cyber & Technology Operational Risk Technical Coverage, Vice President, Hong Kong/Singapore

At Goldman Sachs, we connect people, capital and ideas to help solve problems for our clients. We are a leading global financial services firm providing investment banking, securities and investment management services to a substantial and diversified client base that includes corporations, financial institutions, governments and individuals.

About the Role

• •The Operational Risk Department is an independent risk management function responsible for developing and implementing a standardized framework to identify, measure, monitor, and assess operational risk across the firm.
• •This role will provide technically credible, independent second-line-of-defense oversight and challenge of cyber and technology operational risk across APAC. The individual will operate as a regional technical coverage resource across the full Cyber & Technology Operational Risk portfolio, supporting priorities led by the team's oversight leads for technology infrastructure and assets, security operations and identity, technology change and resilience, insider threat, data security, and vulnerability and patch management.
• •The successful candidate will combine broad engineering and cybersecurity knowledge with strong risk judgment. The role requires the ability to move between detailed technical evidence and senior-level risk conclusions, partner with regional and global stakeholders, and support multiple coverage teams as risks, regulatory priorities, incidents, assessments, and change initiatives evolve.

Job Responsibilities

• •Provide independent 2LoD oversight and credible challenge across APAC technology and cybersecurity activities, while remaining able to support global reviews and thematic work where regional systems, services, entities, or stakeholders are in scope.
• •Assess technology architectures, service designs, operating processes, standards, controls, inventories, metrics, incidents, issues, and remediation plans using evidence from engineering documentation, telemetry, testing, governance materials, and structured data.
• •Identify, monitor, and analyze risk across enterprise infrastructure and technology assets, including compute, storage, databases, middleware, networks, end-user platforms, data centers, virtualization, containers, public cloud services, platform dependencies, asset lifecycle, end-of-life technology, configuration, capacity, backup, recovery, and infrastructure security.
• •Review and challenge security operations and identity capabilities, including security monitoring, detection engineering, logging and telemetry coverage, incident response, threat hunting, privileged and production access, authentication, authorization, segregation of duties, identity lifecycle, and access governance.
• •Review technology change and software delivery risk across architecture, secure software development, source code and dependency management, CI/CD, testing, release and deployment controls, change governance, production readiness, rollback, vulnerability response, and post-implementation monitoring.
• •Assess technology resilience and incident management, including service mapping, operational readiness, observability, availability, failover, disaster recovery, capacity management, recovery objectives, severe-but-plausible scenario testing, technology incident response, root-cause analysis, and lessons learned.
• •Evaluate data security and insider threat risks, including data classification, access pathways, data loss prevention, encryption and key management, data movement, monitoring of anomalous activity, surveillance dependencies, investigation processes, and control coverage for sensitive information.
• •Assess vulnerability and patch management capabilities across infrastructure, applications, cloud, containers, network devices, end-user technology, and mobile platforms, including asset coverage, scanning, severity and exploitability, treatment plans, exceptions, remediation performance, penetration testing, and bug bounty activity.
• •Analyze dependencies among business services, applications, data, infrastructure, cloud and on-premises platforms, third parties, and foundational services to identify concentration, propagation, and control risks that may not be visible through individual system reviews.
• •Contribute to RCSAs and other risk assessments by evaluating risk identification, control design, control implementation, operating effectiveness, residual risk, evidence quality, and consistency with the firmwide methodology.
• •Lead or support thematic reviews and maturity assessments across cyber and technology processes, developing technically grounded conclusions, clear ratings, and practical recommendations for senior stakeholders.
• •Review operational risk events, near misses, security incidents, technology incidents, external events, and control failures to identify themes, systemic exposures, emerging risks, and required escalation.
• •Perform detailed review of issues and action plans, including root cause, severity, scope, affected assets and services, interim controls, risk acceptance, remediation design, milestones, closure evidence, and sustainability.
• •Review New Activities, material technology changes, cloud migrations, platform transformations, acquisitions, and regional implementations to determine whether cyber, technology, resilience, data, and third-party risks are appropriately identified and managed before go-live.
• •Develop and use quantitative and qualitative analysis to assess control health and risk trends, including work with inventories, key indicators, testing results, incident data, issues, engineering metrics, and governance reporting. Use SQL, scripting, visualization, or other analytics techniques where appropriate.
• •Participate in relevant APAC and global governance forums; provide concise risk insights, challenge, and escalation to senior management and committees; and support engagement with regulators and internal assurance functions.
• •Monitor APAC regulatory and industry developments affecting technology, cybersecurity, operational resilience, data, cloud, third-party services, and AI-enabled technology risks, and translate applicable expectations into focused oversight activity.
• •Improve the team's technical coverage methods, assessment procedures, evidence standards, analytics, reporting, and reusable review approaches, while sharing knowledge across regional and global team members.

Qualifications

• •7+ years of relevant experience in technology engineering, cybersecurity, technology risk, operational resilience, operational risk, internal audit, controls assurance, or a related discipline within a complex organization.
• •Broad technical knowledge across infrastructure, cloud, networking, identity, cybersecurity operations, software delivery, technology resilience, data security, vulnerability management, and technology asset management, with depth in at least two of these areas.
• •Ability to review technical architectures, data flows, service dependencies, control designs, engineering standards, telemetry, inventories, metrics, test results, incidents, and remediation evidence and translate them into clear risk conclusions.
• •Experience assessing control design and operating effectiveness and performing risk assessments, maturity assessments, thematic reviews, issue validation, or evidence-based assurance activities.
• •Working knowledge of public cloud and modern engineering patterns, including containers, orchestration, infrastructure as code, CI/CD, APIs, distributed services, observability, secrets management, and third-party technology dependencies.
• •Knowledge of security and technology risk frameworks and guidance such as NIST Cybersecurity Framework, NIST SP 800-53, ISO 27001, COBIT, FFIEC, CIS Controls, and Cloud Security Alliance Cloud Controls Matrix.
• •Familiarity with APAC regulatory ex