Risk – Technology Operational Risk

The Operational Risk Department at Goldman Sachs is an independent risk management function responsible for developing and implementing a standardized framework to identify, measure, and monitor operational risk across the firm. AI Coverage is a specialized role within this framework, dedicated to strengthening the firm's oversight of operational risks arising from the firm's adoption and use of artificial intelligence. This professional will be responsible for continuously identifying, monitoring, measuring, and assessing operational risks associated with AI platforms, foundational models, agentic systems, and the infrastructure, vendors, and data that support them — ensuring the firm's AI footprint is built, operated, and governed in a manner consistent with the firm's operational resilience, third-party risk, and data governance frameworks, policies, and standards. The role is intentionally broad: the successful candidate may bring deep expertise in one of several adjacent risk disciplines, provided that expertise is grounded in direct experience evaluating or managing risk in AI, machine learning, or agentic technology environments.

Responsibilities:

AI Resilience & Operational Continuity

• Identify, monitor, and analyze operational risks arising from AI system resilience, including infrastructure unavailability, foundational model outages, non-deterministic behavior under stress, cascading multi-agent failures, model degradation from data drift, and unavailability of third-party hosted LLMs and MCP server ecosystems.
• Ensure AI systems qualifying as dependent or Integral Assets to Important Business Services (IBSs) are mapped within Business Continuity Plans, subject to Impact Tolerance Statements, and supported by alternate workaround strategies (e.g., model fallback, alternate vendors).
• Champion resilience-by-design principles (modularity, diversity, redundancy, adaptability) and challenge gaps in controls such as AI Model Version Pinning, AI System Observability, multi-data-center deployment, and circuit-breaker/fallback procedures.

• Conduct evidence-based scenario analysis and support integrated/asset-based testing of AI-dependent IBSs, coordinating with 1LoD Engineering, TPRM, and business stakeholders to confirm the firm remains within impact tolerances (RTO/RPO/SLA) during disruption.

AI Third-Party & Supply Chain Risk

• Identify, monitor, and analyze operational risks from third-party AI services, externally hosted LLMs, and vendor-supplied foundation models, including information leakage, model tampering, MCP server supply chain compromise, and agent-mediated credential harvesting.
• Oversee vendor due diligence, third-party model validation, and SLA enforcement for AI safety, performance, and Denial-of-Wallet monitoring, escalating contractual breaches.

• Monitor the AI third-party control inventory (e.g., AI Data Leakage Prevention, MCP Server Security Governance, Agentic System Credential Protection Framework) for sufficiency and completeness.

AI Data Governance

• Apply the Firmwide Policy and Standard for Data Governance to AI use cases, ensuring Datasets used to train, fine-tune, ground (e.g., RAG/vector databases), or operate AI and agentic systems are inventoried, risk-tiered, and have clearly assigned Owners, Secondary Owners, and Senior Owners.
• Challenge the adequacy of Data Quality controls (accuracy, completeness, timeliness) and Data Lineage documentation for datasets feeding AI model pipelines, particularly where data crosses divisional boundaries or lacks Data Contracts.
• Assess whether Authoritative Data Sources (ADS) used by AI/ML systems meet governed-access, reconciliation, and change-management requirements, and escalate reliance on non-ADS or ungoverned data sources (e.g., unvetted training corpora, scraped data) as Data Defects or exceptions.

• Review AI-related Data Defects and Data Requests for appropriate logging, remediation, and escalation per the Firmwide Standard for Data Defect and Data Request Management.

Cross-Cutting Risk Management

• Conduct data analysis to identify trends in AI availability, observability telemetry, vendor performance, and data quality metrics; escalate concerns to senior management when warranted.
• Facilitate Operational Risk Event reporting for AI resilience, third-party, and data-related incidents.
• Contribute to divisional risk profile assessments, RCSA review and challenge, and New Activity reviews for AI model deployments, vendor engagements, and data sourcing changes.
• Remain current on regulatory and industry developments (e.g., EU AI Act, NIST AI 600-1, FFIEC IT Booklet) impacting AI resilience, third-party, and data governance obligations.
• Identify and drive initiatives to improve AI risk management practices across resilience, third-party, and data domains.

Qualifications

• Strong understanding of operational resilience (BCP, impact tolerances, RTO/RPO), third-party risk management (vendor due diligence, SLA governance), and/or data governance (data lineage, data quality, ADS/PDE frameworks) — candidates need not have deep expertise in all three, but must demonstrate direct experience applying one or more of these disciplines to AI/ML systems.
• Strong understanding of AI/ML architecture: foundation models, LLMs, RAG systems, agentic AI frameworks, MCP servers, vector databases, and model deployment infrastructure.
• Experience with resilience-by-design, AI vendor/supply chain controls, or data quality control frameworks applied to AI pipelines.
• Knowledge of relevant control frameworks (NIST 800-53, NIST AI 600-1, ISO 27001, EU AI Act) and/or the firm's Data Governance Policy/Standard.
• 7+ years of relevant experience in operational risk, resilience/BCP, third-party risk management, data governance, a financial institution's technology division, or a technology company building/maintaining enterprise AI/ML systems.
• Strong verbal and written communication skills with the ability to present with impact and influence.
• Ability to work in a fast-paced environment with strong delivery focus; strong organizational skills; project management experience a plus.
• Proficiency in Word, Excel, PowerPoint, SharePoint/OneDrive; SQL, graph databases, and Tableau a plus.
• Relevant certifications such as CISA, CISM, CBCP/MBCI, CTPRP, or related AI/ML, data, and resilience certifications.

• Bachelor's Degree in Computer Science, Cybersecurity, Business and Technology Management, Finance, Data Science, or related disciplines.

  The Risk division is responsible for credit, market and operational risk, model risk, independent liquidity risk, and insurance throughout the firm.