Internal Audit – Foundation Engineering / Tech Risk and Cybersecurity, Associate, Singapore

WHAT WE DO
As the third line of defense, Internal Audit’s mission is to independently assess the firm’s internal control structure, including its governance processes, risk management practices and control environment. Internal Audit evaluates the effectiveness of controls that mitigate current and emerging risks, raises awareness of control risk, and monitors management’s implementation of control measures.
Goldman Sachs Internal Audit is organized into global teams comprising business and technology auditors covering the firm’s businesses and functions, including technology, cybersecurity, engineering, risk management, finance and other critical areas.
WHO WE LOOK FOR
Goldman Sachs Internal Auditors demonstrate strong risk and control mindsets, analytical skills and professional skepticism, and are able to effectively challenge and engage with management on technology risks and control measures.
We look for individuals who are curious about technology, enjoy understanding complex technology environments, and can translate technical concepts and risks into clear audit assessments. Successful candidates are comfortable working with global teams, building relationships across engineering and risk functions, and operating in a fast-paced and evolving technology environment.
FOUNDATION ENGINEERING / TECH RISK AND CYBERSECURITY AUDIT
The Internal Audit Foundation Engineering / Tech Risk and Cybersecurity team assesses technology and cybersecurity risks and controls across the firm’s technology environment.
The team’s coverage includes areas such as technology infrastructure, cloud platforms, cybersecurity, identity and access management, network and platform security, vulnerability and configuration management, resilience, data protection, technology operations, and emerging technologies.
The role involves:
Executing technology and cybersecurity audits covering infrastructure, platforms, cloud environments, and other foundational technology services.
Understanding complex technology environments and architectures, identifying key technology and cybersecurity risks, and evaluating whether controls are appropriately designed and operating effectively.
Assessing controls across areas such as identity and access management, infrastructure and platform security, cloud security, vulnerability and patch management, configuration management, logging and monitoring, data protection, resilience, and incident management.
Applying a strong risk and control mindset to evaluate both established technologies and new or evolving technology risks, including changes arising from cloud adoption, automation, and emerging technologies.
Working closely with technology stakeholders and global Internal Audit teams to understand technology implementations, assess associated risks and communicate audit observations clearly and effectively.
Considering relevant regulatory requirements, industry standards and supervisory expectations when assessing technology and cybersecurity controls, including requirements applicable within the APAC region.
A strong understanding of technology and cybersecurity concepts, together with experience in technology risk, cybersecurity or technology audit, is important for the role.
YOUR IMPACT
As part of the third line of defense, you will contribute to independent assessments of the firm’s technology and cybersecurity control environment and the effectiveness of controls designed to mitigate current and emerging risks.
You will work with technology and engineering teams as well as Internal Audit colleagues globally to identify and assess technology risks, communicate audit results to management and support the ongoing improvement of the firm’s control environment.
JOB RESPONSIBILITIES
You will:
Participate in the scoping, planning and execution of technology and cybersecurity audits, including identifying key risks and determining appropriate audit testing.
Understand technology processes, architectures and controls and assess their design and operating effectiveness.
Perform audit testing using a combination of technical evidence, data analysis, system configurations, documentation and discussions with engineering and technology stakeholders.
Identify control gaps and clearly articulate the associated technology, cybersecurity, and business risks.
Discuss audit observations and findings with local and global technology management.
Contribute to audit reports and other communications that clearly articulate risks, control observations, and conclusions.
Monitor and follow up on management’s remediation of identified audit findings.