Director, Cloud Assurance

DUTIES & RESPONSIBILITIES

Cloud & AI Security Strategy, Governance & Advisory

Security Strategy & Roadmap: Develop China Agentic Cloud security strategy and roadmap recommendations based on Global security policies, China DSO requirements for AI governance and data security, applicable Chinese regulatory requirements, and the need to respond to major security threats.

Control Framework & Assurance Model: Establish and continuously improve the China Agentic Cloud control framework and assurance mechanisms, defining security objectives, key initiatives, and control priorities.

Security Advisory: Provide security analysis and expert advice for Landing Zone, multi-cloud platforms, shared cloud services, MaaS, Agentic AI, and major cloud scenarios.

Leadership Reporting: Regularly report to the China Cloud Lead on security posture, major risks, control gaps, remediation progress, and capability needs, and recommend risk treatment and resource investment.

Global Security Policy Implementation, Control Framework & Security Architecture Assurance

Policy Translation: Interpret and analyze Global security policies, standards, and requirements applicable to China Agentic Cloud, and translate them into applicable control requirements.

Local Requirements Integration: Incorporate applicable Chinese regulatory requirements, China DSO requirements for AI governance and data security, and major threat response needs into the control framework.

Control Domains & Minimum Requirements: Define control objectives and minimum requirements across network security, identity and access management, data protection, key management, logging and auditing, workloads, PaaS, MaaS, models, and Agents.

Security Architecture Principles & Guardrails: Define China Agentic Cloud security architecture principles, mandatory security requirements, and the control objectives and acceptance criteria for Security Guardrails.

Security Design Review: Conduct security design reviews for Landing Zone, cloud platforms, MaaS, Agentic AI, cloud migration, third-party access, and major changes. Recommend security improvements where gaps exist, and work with the Agentic Cloud Platform Architecture & Engineering Lead to assess practical approaches for implementing the requirements.

Control Implementation Oversight & Platform Collaboration

Requirements to Engineering: Work closely with the Agentic Cloud Platform Architecture & Engineering Lead to translate applicable security requirements into platform architecture standards, engineering controls, Security Guardrails, and operational practices.

Implementation Assessment: Assess whether technical control implementation designs adequately meet the defined control objectives and security requirements.

Engineered Enforcement: Partner with the Agentic Cloud Platform Architecture & Engineering Lead to drive the engineered implementation of security requirements through Landing Zone, Infrastructure as Code (IaC), Policy as Code, standard templates, and Production Readiness Criteria.

Control Monitoring: Monitor the implementation progress, coverage, and operating effectiveness of key controls based on implementation and operational information provided by the platform.

Gap & Deviation Management: Analyze technical constraints, implementation deviations, and control gaps, and agree on remediation plans, alternative approaches, or compensating controls with the Agentic Cloud Platform Architecture & Engineering Lead.

Responsibility Boundaries: Define control responsibility boundaries between the platform layer and the cloud-hosted system or workload layer.

Prioritization Advice: Advise the China Cloud Lead on control implementation priorities, security capability gaps, and improvement plans.

Continuous Security Assurance & Control Effectiveness

Risk-Based Assurance: Establish a risk-driven continuous Security Assurance mechanism, prioritizing work based on platform criticality, data sensitivity, applicable Chinese regulatory requirements, and major threats.

Validation Mechanisms: Work with Agentic Cloud Validation to establish and continuously improve operating mechanisms for day-to-day CSPM management, external attack surface security validation, penetration testing of cloud-hosted systems, and AI red teaming, defining scope, control standards, deliverables, and issue closure requirements.

Assurance Conclusions: Consolidate platform control implementation information, security validation results from Agentic Cloud Validation, and relevant audit information to evaluate the coverage and ongoing effectiveness of key controls, producing assurance conclusions and a remediation status view.

Remediation Effectiveness: Track the remediation of significant issues, evaluate remediation effectiveness based on retest results from Agentic Cloud Validation or other appropriate evidence, and drive continuous improvement of control requirements and assurance mechanisms.

MLPS Assessment Support: Based on control implementation and validation results, support China DSO in Multi-Level Protection Scheme (MLPS) assessments related to China Agentic Cloud, including control status analysis, evaluation of assessment findings, remediation tracking, and coordination of validation results.

Security Compliance

Compliance Mapping: Work closely with Global Security, China DSO, and China Compliance to map applicable Global security policies and data security, AI governance, and security compliance requirements to the China Agentic Cloud control framework, and drive their implementation.

Regulatory Activities: Support MLPS assessments, security filings, and other related activities led by China DSO, coordinating architecture descriptions, control information, and validation evidence, and tracking remediation of related findings.

Audit & Evidence Management: Support internal audits, external audits, compliance inspections, and assessments related to China Agentic Cloud; coordinate evidence and review its quality, ensuring responsible parties provide complete, accurate, consistent, and traceable materials.

Global Alignment: Communicate with Global Security on the local implementation of Global security policies and on the onboarding, coverage, and use of Global security tools in the China Agentic Cloud environment.

JOB REQUIREMENTS & COMPETENCIES

Job requirements

Academic / Professional qualification

Bachelor’s degree or above in Computer Science, Information Security, Software Engineering, or a related discipline;

Recognized security, cloud, or audit certifications preferred, such as CISSP, CISM, CISA, CCSP, CCSK, ISO/IEC 27001 Lead Auditor / Lead Implementer, or professional-level cloud security certifications from major cloud providers (AWS / Alibaba Cloud).

Technical / skill training

In-depth knowledge of cloud security architecture and controls, including network security, identity and access management, data protection, key management, logging and auditing, workload and PaaS security, and Landing Zone design.

Solid understanding of AI and Agentic AI security and governance, including MaaS, model and Agent security risks, AI red teaming, and AI governance frameworks (e.g., NIST AI RMF, ISO/IEC 42001).

Strong knowledge of security control frameworks and assurance methodologies (e.g., ISO/IEC 27001/27017/27018, NIST CSF, CSA CCM), and of applicable Chinese regulatory requirements, including MLPS 2.0, the Cybersecurity Law, the Data Security Law, the Personal Information Protection Law, and generative AI regulations.

Working knowledge of engineered control implementation and monitoring, including Infrastructure as Code (IaC), Policy as Code, Security Guardrails, CSPM, and continuous control monitoring.

Working experience:

Essential

10+ years of experience in information security, cloud security, or IT risk and assurance, including at least 5 years in cloud security architecture, governa