Internal Audit Associate - Foundation Engineering / Tech Risk and Cybersecurity

WHAT WE DO
As the third line of defense, Internal Audit’s mission is to independently assess the firm’s internal control structure, including its governance processes, risk management practices and control environment. Internal Audit evaluates the effectiveness of controls that mitigate current and emerging risks, raises awareness of control risk, and monitors management’s implementation of control measures.

Goldman Sachs Internal Audit is organized into global teams comprising business and technology auditors covering the firm’s businesses and functions, including technology, cybersecurity, engineering, risk management, finance and other critical areas.

WHO WE LOOK FOR 
Goldman Sachs Internal Auditors demonstrate strong risk and control mindsets, analytical skills and professional skepticism, and are able to effectively challenge and engage with management on technology risks and control measures.

We look for individuals who are curious about technology, enjoy understanding complex technology environments, and can translate technical concepts and risks into clear audit assessments. Successful candidates are comfortable working with global teams, building relationships across engineering and risk functions, and operating in a fast-paced and evolving technology environment.

FOUNDATION ENGINEERING / TECH RISK AND CYBERSECURITY AUDIT

The Internal Audit Foundation Engineering / Tech Risk and Cybersecurity team assesses technology and cybersecurity risks and controls across the firm’s technology environment.

The team’s coverage includes areas such as technology infrastructure, cloud platforms, cybersecurity, identity and access management, network and platform security, vulnerability and configuration management, resilience, data protection, technology operations, and emerging technologies.

The role involves:

• Executing technology and cybersecurity audits covering infrastructure, platforms, cloud environments, and other foundational technology services.
• Understanding complex technology environments and architectures, identifying key technology and cybersecurity risks, and evaluating whether controls are appropriately designed and operating effectively.
• Assessing controls across areas such as identity and access management, infrastructure and platform security, cloud security, vulnerability and patch management, configuration management, logging and monitoring, data protection, resilience, and incident management.
• Applying a strong risk and control mindset to evaluate both established technologies and new or evolving technology risks, including changes arising from cloud adoption, automation, and emerging technologies.
• Working closely with technology stakeholders and global Internal Audit teams to understand technology implementations, assess associated risks and communicate audit observations clearly and effectively.
• Considering relevant regulatory requirements, industry standards and supervisory expectations when assessing technology and cybersecurity controls, including requirements applicable within the APAC region.

• A strong understanding of technology and cybersecurity concepts, together with experience in technology risk, cybersecurity or technology audit, is important for the role.

YOUR IMPACT

As part of the third line of defense, you will contribute to independent assessments of the firm’s technology and cybersecurity control environment and the effectiveness of controls designed to mitigate current and emerging risks.

You will work with technology and engineering teams as well as Internal Audit colleagues globally to identify and assess technology risks, communicate audit results to management and support the ongoing improvement of the firm’s control environment.

JOB RESPONSIBILITIES

You will:

• Participate in the scoping, planning and execution of technology and cybersecurity audits, including identifying key risks and determining appropriate audit testing.
• Understand technology processes, architectures and controls and assess their design and operating effectiveness.
• Perform audit testing using a combination of technical evidence, data analysis, system configurations, documentation and discussions with engineering and technology stakeholders.
• Identify control gaps and clearly articulate the associated technology, cybersecurity, and business risks.
• Discuss audit observations and findings with local and global technology management.
• Contribute to audit reports and other communications that clearly articulate risks, control observations, and conclusions.
• Monitor and follow up on management’s remediation of identified audit findings.
• Collaborate with global audit teams to provide effective coverage of technology platforms and services that operate across regions.
• Maintain awareness of developments in cybersecurity, cloud, infrastructure, and emerging technology, as well as relevant regulatory and industry expectations.

BASIC QUALIFICATIONS

• Minimum 4 years of relevant experience in technology audit, cybersecurity audit, technology risk, information security, engineering risk, or a related field. 
• Good understanding of technology and cybersecurity risks and controls, with exposure to areas such as cloud computing, infrastructure, operating systems, networks, identity and access management, vulnerability management, cybersecurity monitoring, or technology resilience. 
• Ability to understand technical architectures and processes and translate them into relevant risks, controls, and audit procedures. 
• Strong analytical and problem-solving skills, with the ability to evaluate technical evidence and reach clear, supportable conclusions. 
• Strong written and verbal communication skills and the ability to communicate effectively with both technical and non-technical stakeholders. 
• Ability to work collaboratively across global teams and engage effectively with technology and engineering stakeholders. 
• Ability to manage multiple priorities and deliver high-quality work in a dynamic environment. 
• Familiarity with relevant technology/cybersecurity standards, frameworks, and regulatory expectations. Knowledge of APAC technology or cybersecurity requirements is beneficial.
• Degree in Computer Science, Information Security, Cybersecurity, Engineering, Information Systems, or a related discipline. 
• Experience conducting audits or risk assessments of cloud environments, technology infrastructure, engineering platforms, or cybersecurity capabilities. 
• Understanding of cloud and infrastructure technologies, including exposure to platforms such as AWS, Microsoft Azure or Google Cloud, and modern infrastructure technologies such as containers and Kubernetes. 
• Familiarity with security and technology frameworks such as NIST Cybersecurity Framework, NIST 800-53, CIS Controls and ISO/IEC 27001. 
• Familiarity with technology and cybersecurity regulatory expectations in jurisdictions such as Singapore and other APAC markets would be advantageous. 
• Relevant professional certifications such as CISA, CISSP, CISM, CRISC, CCSP or cloud-provider certifications are advantageous. 
• Experience using data analytics, scripting, or other technical techniques to support technology audits or control assessments is a plus.

PREFERRED QUALIFICATIONS

• Degree in Computer Science, Information Security, Cybersecurity, Engineering, Information Systems, or a related discipline. 
• Experience conducting audits or risk assessments of cloud environments, technology infrastructure, engineering platforms, or cybersecurity capabilities. 
• Understanding of cloud and infrastructure technologies, including exposure to platforms such as AWS, Microsoft Azure or Google Cloud, and modern infrastructure technologies such as containers and Kubernetes. 
• Familiarity with security and technology frameworks such as NIST Cybersecurity Framework, NIST 800-53, CIS Controls and ISO/IEC 27001. 
• Familiarity with technology and cybersecurity regulatory expectations in jurisdictions such as Singapore and other APAC markets would be advantageous. 
• Relevant professional certifications such as CISA, CISSP, CISM, CRISC, CCSP or cloud-provider certifications are advantageous. 
• Experience using data analytics, scripting, or other technical techniques to support technology audits or control assessments is a plus.

ABOUT GOLDMAN SACHS

At Goldman Sachs, we commit our people, capital and ideas to help our clients, shareholders and the communities we serve to grow. Founded in 1869, we are a leading global investment banking, securities and investment management firm. Headquartered in New York, we maintain offices around the world.  

We believe who you are makes you better at what you do. We're committed to fostering and advancing diversity and inclusion in our own workplace and beyond by ensuring every individual within our firm has a number of opportunities to grow professionally and personally, from our training and development opportunities and firmwide networks to benefits, wellness and personal finance offerings and mindfulness programs. Learn more about our culture, benefits, and people at GS.com/careers.  

We’re committed to finding reasonable accommodations for candidates with special needs or disabilities during our recruiting process. Learn more: https://www.goldmansachs.com/careers/footer/disability-statement.html

©The Goldman Sachs Group, Inc., 2026. All rights reserved.

Goldman Sachs is an equal opportunity employer and does not discriminate on the basis of race, color, religion, sex, national origin, age, veterans status, disability, or any other characteristic protected by applicable law.