Risk, APAC Cyber & Technology Operational Risk Technical Coverage, Vice President, Tokyo

Minato-Ku, Tokyo, Japan

About the role

At Goldman Sachs, we connect people, capital and ideas to help solve problems for our clients. We are a leading global financial services firm providing investment banking, securities and investment management services to a substantial and diversified client base that includes corporations, financial institutions, governments and individuals.

About the Role

The Operational Risk Department is an independent risk management function responsible for developing and implementing a standardized framework to identify, measure, monitor, and assess operational risk across the firm.
This role will provide technically credible, independent second-line-of-defense oversight and challenge of cyber and technology operational risk across APAC. The individual will operate as a regional technical coverage resource across the full Cyber & Technology Operational Risk portfolio, supporting priorities led by the team's oversight leads for technology infrastructure and assets, security operations and identity, technology change and resilience, insider threat, data security, and vulnerability and patch management.
The successful candidate will combine broad engineering and cybersecurity knowledge with strong risk judgment. The role requires the ability to move between detailed technical evidence and senior-level risk conclusions, partner with regional and global stakeholders, and support multiple coverage teams as risks, regulatory priorities, incidents, assessments, and change initiatives evolve.

Job Responsibilities

Provide independent 2LoD oversight and credible challenge across APAC technology and cybersecurity activities, while remaining able to support global reviews and thematic work where regional systems, services, entities, or stakeholders are in scope.
Assess technology architectures, service designs, operating processes, standards, controls, inventories, metrics, incidents, issues, and remediation plans using evidence from engineering documentation, telemetry, testing, governance materials, and structured data.
Identify, monitor, and analyze risk across enterprise infrastructure and technology assets, including compute, storage, databases, middleware, networks, end-user platforms, data centers, virtualization, containers, public cloud services, platform dependencies, asset lifecycle, end-of-life technology, configuration, capacity, backup, recovery, and infrastructure security.
Review and challenge security operations and identity capabilities, including security monitoring, detection engineering, logging and telemetry coverage, incident response, threat hunting, privileged and production access, authentication, authorization, segregation of duties, identity lifecycle, and access governance.
Review technology change and software delivery risk across architecture, secure software development, source code and dependency management, CI/CD, testing, release and deployment controls, change governance, production readiness, rollback, vulnerability response, and post-implementation monitoring.
Assess technology resilience and incident management, including service mapping, operational readiness, observability, availability, failover, disaster recovery, capacity management, recovery objectives, severe-but-plausible scenario testing, technology incident response, root-cause analysis, and lessons learned.
Evaluate data security and insider threat risks, including data classification, access pathways, data loss prevention, encryption and key management, data movement, monitoring of anomalous activity, surveillance dependencies, investigation processes, and control coverage for sensitive information.
Assess vulnerability and patch management capabilities across infrastructure, applications, cloud, containers, network devices, end-user technology, and mobile platforms, including asset coverage, scanning, severity and exploitability, treatment plans, exceptions, remediation performance, penetration testing, and bug bounty activity.
Analyze dependencies among business services, applications, data, infrastructure, cloud and on-premises platforms, third parties, and foundational services to identify concentration, propagation, and control risks that may not be visible through individual system reviews.
Contribute to RCSAs and other risk assessments by evaluating risk identification, control design, control implementation, operating effectiveness, residual risk, evidence quality, and consistency with the firmwide methodology.
Lead or support thematic reviews and maturity assessments across cyber and technology processes, developing technically grounded conclusions, clear ratings, and practical recommendations for senior stakeholders.
Review operational risk events, near misses, security incidents, technology incidents, external events, and control failures to identify themes, systemic exposures, emerging risks, and required escalation.
Perform detailed review of issues and action plans, including root cause, severity, scope, affected assets and services, interim controls, risk acceptance, remediation design, milestones, closure evidence, and sustainability.
Review New Activities, material technology changes, cloud migrations, platform transformations, acquisitions, and regional implementations to determine whether cyber, technology, resilience, data, and third-party risks are appropriately identified and managed before go-live.
Develop and use quantitative and qualitative analysis to assess control health and risk trends, including work with inventories, key indicators, testing results, incident data, issues, engineering metrics, and governance reporting. Use SQL, scripting, visualization, or other analytics techniques where appropriate.
Participate in relevant APAC and global governance forums; provide concise risk insights, challenge, and escalation to senior management and committees; and support engagement with regulators and internal assurance functions.
Monitor APAC regulatory and industry developments affecting technology, cybersecurity, operational resilience, data, cloud, third-party services, and AI-enabled technology risks, and translate applicable expectations into focused oversight activity.
Improve the team's technical coverage methods, assessment procedures, evidence standards, analytics, reporting, and reusable review approaches, while sharing knowledge across regional and global team members.

Qualifications

7+ years of relevant experience in technology engineering, cybersecurity, technology risk, operational resilience, operational risk, internal audit, controls assurance, or a related discipline within a complex organization.
Broad technical knowledge across infrastructure, cloud, networking, identity, cybersecurity operations, software delivery, technology resilience, data security, vulnerability management, and technology asset management, with depth in at least two of these areas.
Ability to review technical architectures, data flows, service dependencies, control designs, engineering standards, telemetry, inventories, metrics, test results, incidents, and remediation evidence and translate them into clear risk conclusions.
Experience assessing control design and operating effectiveness and performing risk assessments, maturity assessments, thematic reviews, issue validation, or evidence-based assurance activities.
Working knowledge of public cloud and modern engineering patterns, including containers, orchestration, infrastructure as code, CI/CD, APIs, distributed services, observability, secrets management, and third-party technology dependencies.
Knowledge of security and technology risk frameworks and guidance such as NIST Cybersecurity Framework, NIST SP 800-53, ISO 27001, COBIT, FFIEC, CIS Controls, and Cloud Security Alliance Cloud Controls Matrix.
Familiarity with APAC regulatory expectations relating to technology risk, cybersecurity, operational resilience, outsourcing, cloud, data protection, and incident reporting. Direct experience working with one or more APAC regulators is beneficial.
Strong analytical capability, including the ability to work with structured and unstructured data to identify anomalies, trends, dependencies, control gaps, and systemic risk. Experience with SQL, Python, data visualization, graph analysis, or similar tools is beneficial.
Strong business judgment and the ability to connect technical risk to critical business services, client and market impact, legal entities, operational resilience, and the firm's risk appetite.
Clear written and verbal communication skills, with the ability to explain complex technical matters to non-technical stakeholders, present with impact, and influence senior engineering and risk leaders.
Ability to manage multiple priorities, operate independently across time zones, respond effectively to incidents and regulatory requests, and deliver high-quality work in a fast-paced environment.
Relevant certifications such as CISSP, CISA, CISM, CRISC, CCSP, cloud platform certifications, GIAC, CBCP/MBCI, network certifications, or similar credentials are beneficial.
BA or BS degree in Computer Science, Engineering, Information Systems, Cybersecurity, Data Science, Business, or a related discipline, or equivalent practical experience.

Core Attributes

Technically curious and comfortable challenging specialists using evidence and sound engineering logic.
Independent and objective, with the judgment to distinguish material risk from technical detail that does not change the risk outcome.
Flexible and collaborative, able to shift across coverage areas and support different team priorities without losing ownership or quality.
Concise and practical, with a focus on clear conclusions, actions, accountable owners, and sustainable risk reduction.

ABOUT GOLDMAN SACHS

At Goldman Sachs, we commit our people, capital and ideas to help our clients, shareholders and the communities we serve to grow. Founded in 1869, we are a leading global investment banking, securities and investment management firm. Headquartered in New York, we maintain offices around the world.

We believe who you are makes you better at what you do. We're committed to fostering and advancing diversity and inclusion in our own workplace and beyond by ensuring every individual within our firm has a number of opportunities to grow professionally and personally, from our training and development opportunities and firmwide networks to benefits, wellness and personal finance offerings and mindfulness programs. Learn more about our culture, benefits, and people at GS.com/careers.

We’re committed to finding reasonable accommodations for candidates with special needs or disabilities during our recruiting process. Learn more: https://www.goldmansachs.com/careers/footer/disability-statement.html

Goldman Sachs is an equal opportunity employer and does not discriminate on the basis of race, color, religion, sex, national origin, age, veterans status, disability, or any other characteristic protected by applicable law.